🔷 ChatGPT will read patient charts directly out of Epic. Let’s ask how much of what it’s reading was already written by another AI.

🔷 CIOs are calling Epic “too big for its britches.” The angst is real, but it isn’t new, and Epic has spent two decades proving the angst doesn’t change behavior.

🔷 Epic’s Rangers program puts Epic’s own staff inside your IT department. They’ll have tools your outside consultants don’t.

🔷 ShinyHunters stole 284 million records from McKesson with a phone call, not an exploit. Hospitals are being told they need better AI defenses. They need better password hygiene.

🔷 Maryland says Optum’s Medicaid system never worked for eight months. Optum disagrees. Nobody outside a courtroom is going to know who’s right.

✅️ Off-Label: a $2,000 cream and a $1 fix that worked instead. The system doesn’t hide cheap solutions by accident.

The Feed is a quick take on the week’s highest-profile health IT news items, with one piece from outside the beat at the end. The two Epic quick hits below are free; the full issue is for paid subscribers.

OpenAI’s Epic integration is still an early pilot. It’s not really live, but the window to plan for it is now. Positioning your organization for outside AI tools reading your Epic data takes someone who understands how physicians actually think, how your organization operates, and how Epic works, together, not any one of those alone, and that’s exactly the kind of Epic problem I work on. I run a 30-minute Epic Strategy Review. A working conversation, not a pitch. You describe the specific Epic problem you’re wrestling with, I tell you what I see, and by the end of 30 minutes we land in one of three places: a natural next step, an honest “you don’t need me yet,” or a clean “not a fit.” Book some time here.

John Lee is an emergency physician and Epic consultant who helps health systems bridge the gap between Epic’s capabilities and operational reality. He specializes in data architecture, registry optimization, and making Epic’s tools actually deliver results.

Also on LinkedIn and at hitpeakadvisors.com.

ChatGPT Can Read Your Epic Chart Now. Ask What Already Wrote It.

OpenAI expanded ChatGPT for Healthcare this week to connect directly to Epic. Authorized clinicians can now pull Epic patient’s notes, labs, medications, and specialist documentation into ChatGPT. It will be read only. UCSF Health and AdventHealth are named as early partners. OpenAI is touting the advantages with its own numbers (shocking): physician advisors across 60 countries and 26 specialties reviewed more than 700,000 responses, rating 99.1 percent safe across 27 use cases and better than 93 percent good-or-better on accuracy.

Everyone will read those numbers as validation and optimism. A physician panel grading AI output against real clinical judgment is the correct architecture. It needs to be an external, human-validated check, not an AI checking its own data. To that end, the loop that should worry you is downstream. Ambient AI scribing is spreading. A growing share of what’s actually in the records that ChatGPT and other AI tools consume was drafted by another (or even the same) AI. The note, the med list, and the specialist documentation are all being generated at scale by AI scribes. ChatGPT’s 93 percent accuracy number measures whether it summarized the chart correctly. It says nothing about whether the chart itself was already another AI’s interpretation of what happened in the room. That’s AI cannibalism: the model trained and graded against a corpus another model helped write. Where does the human validation come into play, and what is the real ground truth that a human has to validate against?

None of that makes this a crack in Epic’s moat. It’s the early version of a growing list of outside AI tools plugging into Epic, not around it, because Epic is still where the data lives. Remember when Claude Code briefly looked like it might gut Salesforce, and the market clobbered Salesforce? Benioff didn’t fight the narrative. He redesigned the factory floor, turned AI into a lever instead of a competitor, and turned the crisis into a demo of how AI tools layer on top of a system of record instead of replacing it, a shift Salesforce and Benioff highlighted on their recent earnings calls. This pattern is now arriving in health IT. More on that, and why I think we need to think in layers tomorrow.

Is Epic Overreaching? It’s Betting It Can Still Deliver.

CIOs are publicly asking whether Epic’s expansion into ERP (EpicOps), staffing (Rangers), payments (Savvy), and AI token pricing (Tokenomics) is a sign Epic is too big for its britches. Add the backdrop of Epic’s FTC antitrust narrative and the result is CIO handwringing.

Yes, every one of these tools deepens the same trade Epic has always offered: give up the interfacing headache of best-of-breed but take on deeper dependence on a single vendor with real pricing power over you. That trade creates chronic CIO angst that is only growing. The conundrum is that Epic keeps delivering well enough that the angst never turns into defection. None of EpicOps, Savvy, or Tokenomics is really a far reach outside Epic’s lane, either, if you think about how clinical, operational, financial, and AI-token resourcing are intertwined in how we need to operate in healthcare. The open question isn’t whether Epic should be doing this. It’s whether Epic can keep doing all of it at once without cracking under its own scope.

Read more

🔷 Epic launched real-time prior authorization at four health systems. What does that actually mean?

🔷 Northwell just finished ripping out 30-plus EHRs for a single $1.2 billion Epic instance. The real driver wasn’t the hospitals. It was the same Epic story we keep hearing: data.

🔷 A federal watchdog found Medicare Advantage plans overturn a large number of their own denials the moment someone bothers to appeal.

🔷 JAMA says physicians make AI worse. How did they define worse or better?

🔷 A product-safety agency wanted your ER charts routed through a contractor. The contractor was only going to use it for a narrow use case. It promised.

✅️ Off-Label: the same federal law that lets a hospital lock in 90 percent of a doctor’s referrals gave that same doctor almost no path to ever own a piece of the hospital back.

The Feed is a quick take on the week’s highest-profile health IT news items, with one piece from outside the beat at the end. The two Epic quick hits below are free; the full issue is for paid subscribers.

If your organization is celebrating Epic’s real-time prior auth rollout without asking what portion of the actual PA burden it touches, this is exactly the kind of Epic problem I work on. I run a 30-minute Epic Strategy Review. A working conversation, not a pitch. You describe the specific Epic problem you’re wrestling with, I tell you what I see, and by the end of 30 minutes we land in one of three places: a natural next step, an honest “you don’t need me yet,” or a clean “not a fit.” Book some time here.

John Lee is an emergency physician and Epic consultant who helps health systems bridge the gap between Epic’s capabilities and operational reality. He specializes in data architecture, registry optimization, and making Epic’s tools actually deliver results.

Also on LinkedIn and at hitpeakadvisors.com.

Epic’s Real-Time Prior Auth Isn’t Real-Time. It’s a Flag.

Epic celebrated launching real-time prior authorization checks at four health systems this month, five months ahead of the CMS deadline. I celebrated too. That was the headline, but there was a bit of a catch. Scott Rossignol, was implementing the tool with an Epic provider org and flagged a two-app registration requirement that caused a split in the workflow. Stuart Akerman, a practicing gastroenterologist, put it more bluntly. The “prior auth” feature flags that a PA will be needed. It doesn’t submit one and certainly doesn’t resolve one.

This is a theme in healthcare IT where the semantics run ahead of the reality. Meaningful Use promised electronic records would transform care and notoriously turned physicians into the most expensive clerks in history. In this case, a flag isn’t a full, seamless prior authorization in any way a patient or clinician would recognize. It’s some of the work and it is progress but gathering the data for submission, supporting adjudication, and writing a well-curated appeal when the denial comes anyway are still a long ways away.

I’d also note a gap in who has the power to fix this dysfunction. Helping patients is only an afterthought. A big push comes from payers. Payers are interested in a real-time flag because it reduces their labor cost, not because it addresses why prior authorization exists as friction in the first place. They like the friction. They just don’t like what it costs them to deliver it.

Northwell’s $1.2 Billion Bet Isn’t About Epic. It’s About the Ambulatory Data Nobody Could See.

Northwell finished moving 70,000 users onto a single Epic instance across its 28 hospitals and $25 billion in revenue, with one go-live wave left in November. The headline is the vendor consolidation: 30-plus legacy systems retired under one Chronicles instance.

The real driver sits underneath that. Before this project, Northwell had roughly 5,000 physicians and 1,500-plus advanced care providers spread across more than 30 ambulatory EMRs, a patchwork that made care transitions a guessing game and population-level analytics close to impossible. What Northwell bought with $1.2 billion is a normalized dataset across a business now less than half hospital revenue and growing outward. That’s the real driver. We can talk all we want about interoperability, but the least worst way to achieve it enterprise-wide right now is to buy Epic.

Read more

At UGM this year, I got some hands-on time with Agent Factory in one of their usability labs. It was only about 30 minutes, but actually using the tool, instead of watching a demo on a screen, gave me insight on where Agent Factory is (or could be) headed for third-party software developers and Epic organizations.

As many of you know, Epic has long treated API access like a controlled substance. Getting into Chronicles, Clarity, or Caboodle meant an IRS-like approval process and sponsorship from a provider organization, followed by iterative requests for more access and more bureaucracy. Epic does a lot to earn its walled-garden reputation. That could sound like a negative, but Epic hasn’t won the EHR race because its software worked with any 3rd party that asked. Epic won because it never let a third-party platform become a dependency it had to work around. (I’ve written about that history here.)

The Sanctum Is Still Locked. Epic Just Built a Lobby.

I’m not sure this is fully by design, but Agent Factory’s connectors and MCP engineering amount to Epic building an application layer on top of the protected sanctum that is Chronicles. The connector framework is the shell. It gives third parties and provider organizations the flexibility they’ve wanted for years. The vault stays exactly as locked as it’s always been.

I predict that provider organizations will configure, activate, and monitor the connectors themselves, working with the third party to build the connection. Epic built the door. The provider decides who walks through the door, and with that comes the overhead and liability. That responsibility is transferred from Epic to the provider organization while Epic still guards the gates.

I know what you’re thinking. Why would a company that’s spent 20-plus years tightly controlling dependencies suddenly release control? Because it isn’t releasing control. Chronicles, Clarity, and Caboodle remain the system of record and the ground truth.

The changes in software development are now filtering into Epic’s interoperability. Every prior generation of integration depended on HL7, a custom API, or FHIR, and computer languages that are deterministic: they do exactly what they’re told and nothing else. Every connection had to be pre-specified and pre-mapped before it could run. It was rigid and brittle. Finding and fixing the brittle bricks was a big part of software engineering. What’s changed is that the computer language is now English. An LLM interpreting a prompt inside an MCP connector doesn’t need the same rigid contract the old interface engine did. That’s the technical unlock, and it’s also what makes the shift in responsibility possible. This approach will no longer require more bespoke, explicitly dictated, analyst-mediated builds required on Epic’s side for every connection.

Or at least that’s the theory. We’ll see how much control Epic actually hands over.

The Same Shift I Wrote About in March

I wrote about a version of this argument back in March, but it was about a different workflow. I’d been moving research output between Perplexity, NotebookLM, and Claude using structured markdown, no API calls, no schema, no data dictionary, while fighting clunky CCDs and fax documents in my health IT work. The argument I made was that markdown could deliver the same English-as-interface unlock and replace thirty years of rigid interoperability standards. The difference is who’s in the swivel seat. In March, it was me. With Agent Factory, it’s Epic and connectors.

The asymmetry between building inside the EMR and outside it is a house addition versus an RV parked on the property. The RV is fast and unconstrained, but it forces you to cross the yard and live in two systems at once, which is where third-party innovation tends to stall.

Agent Factory is neither. It’s not an RV, because it doesn’t sit outside the house. It’s not a house addition either, with all its development and project overhead. Call it a guest suite Epic is building onto its house: its own entrance, its own lock, and a very clear understanding of who’s liable if the guest leaves the stove on. You furnish it. You don’t get keys to the rest of the house.

The One Edge Vendors Had Left

Epic’s house-addition pace has been thoughtful, constrained, slower, and conservative. But it always had a cost. The freer ecosystem outside the walls moves faster precisely because it isn’t constrained the same way: more players, more parallel experiments than Epic would ever greenlight. Epic could out-execute you but it couldn’t out-iterate you.

Agent Factory’s connector framework is a way to capture that exact advantage, and it does three things at once. It deepens Epic as the system of record, since every connector still executes against Chronicles regardless of who built on top of it. It inoculates Epic against the antitrust arguments I’ve written about elsewhere: “Look how many independent developers build on our platform” is a much harder case to prosecute than “we don’t let anyone in because our data is sacred.” And it pulls the democratized, fast-moving, vibe-coding energy that’s reshaping software development onto Epic’s world, but also on Epic’s terms. All this activity generates value Epic didn’t have to build while still keeping final say.

Where This Creates Room to Work

This is the part I didn’t fully register until I’d left UGM and spoke with some colleagues about the future of Agent Factory. If Epic leans into this approach, it opens a lane for third-party developers and consultants that didn’t really exist before.

The shift is in the nature of the work itself. A developer who might have spent five years building a standalone platform, competing for budget, fighting for an integration partner, and living permanently in the RV now has a narrower but far more accessible version of that skill available: writing the connector logic, prompts, instructions, and control flow that let an agent run correctly inside a provider org’s Agent Factory environment. You’re not building software that has to compete with Epic’s roadmap. You’re building the orchestration tool for software that Epic already built, in direct partnership with the provider org aligned on the outcome.

Anyone who’s used a Windows machine versus a Mac or iPad already understands this tradeoff. Windows lets you touch almost anything, and what you get for that freedom is a lifetime of driver conflicts and configuration files that break in ways nobody can fully explain. (I restart my Windows PC almost daily.) Apple went the other way: build for iOS and you’re inside a walled garden, submitting to review, accepting that Apple can reject or pull your app whenever it wants. That constraint is precisely what built the App Store into a real economy. Millions of developers made sustainable businesses inside somebody else’s walls because the alternative to constrained access wasn’t freedom. It was no audience at all.

I expect Agent Factory to run the same play; it will be the real App Orchard, where the constraint is the integration and the integration is the product. The developers who do well won’t be the ones who resent the walls. They’ll be the ones who recognize that the walls create the ecosystem.

That’s a genuinely different opportunity than “build a platform and hope Epic doesn’t eat your lunch.” It rewards someone who understands both the clinical and operational workflows and how to get an LLM to behave predictably inside a constrained environment. If I were advising a vendor or independent consultant here, I’d tell them to stop treating this opportunity as a smaller version of platform-building and start treating it as a bespoke cross between software development and consulting. The early money and relationships go to whoever gets fluent before fluency is obviously required. Skate to where the puck is going, not to where the API used to be.

And if I were Epic, I’d be pounding this exact drum in every regulatory conversation happening in Washington right now. A connector framework this permissive is the easiest answer available to anyone asking whether Epic actually supports open interoperability. I and others covered the FTC angle elsewhere ad nauseum and won’t rehash it here, but it’s clear to me that the same architecture that creates a business opportunity for developers is the architecture Epic can point to as evidence it never needed to be forced open.

What Provider Organizations Should Actually Be Deciding

Not many health systems will fully leverage this capability on day one. That’s fine. Vibe coding is easy to say but harder to do. The ones who get ahead of it aren’t waiting for Epic’s official playbook. They’re already thinking about which decision boundary we are actually willing to own.

Because that’s what this comes down to underneath the connector diagrams and the Cool Stuff Ahead demos. Epic didn’t loosen its grip on the operational backbone. It built a room next to it, handed provider organizations the keys, and made sure everyone signed the lease. The developers and consultants who figure out how to furnish that room well, before the market realizes it exists, are the ones who’ll matter in the long run. Provider organizations that know what they own when they flip the switch can get a head start and avoid being lapped by their competition.

If you’re a vendor or independent developer trying to work out whether Agent Factory’s connector layer is the opportunity of the next five years or the framework that quietly absorbs the one edge you had left, this is exactly the kind of Epic problem I work on.

I run a 30-minute Integration Seam Diagnostic. A diagnostic call, not a sales call. You describe how your product isn’t fitting inside Epic, I tell you what I see, and by the end of 30 minutes we land in one of three places: a natural next step, an honest “not right now,” or a clean “not a fit.” Book some time here.

John Lee is an emergency physician and Epic consultant who helps clinical and clinical-adjacent technology vendors close the gap between what their product does and how clinicians actually work inside Epic, so integrations land as native, adopted, and workflow-appropriate rather than as bolt-ons clinicians resent.

Also on LinkedIn and at hitpeakadvisors.com.

🔷 Epic’s best AI product isn’t Ergo. It’s the 320-million-patient database that will unlock its value.

🔷 Epic doesn’t need to out-build Abridge. It needs to out-price and out-last it inside a bundle.

🔷 Only 3 of 1,357 FDA-cleared AI medical devices have ever been tested on whether they actually help patients. Fee-for-service economics rears its ugly head again.

🔷 Fitch just told hospital boards a ransomware attack isn’t a HIPAA problem anymore. It’s a bond-rate problem.

🔷 Epic just landed a huge European deal. Same Epic story. They got tired of siloed data.

✅️ Off-Label: a viral wellness economy runs on the same broken-trust problem Cosmos and Curiosity might someday help fix.

The Feed is a quick take on the week’s highest-profile health IT news, with one piece from outside the beat at the end. The two Epic quick hits below are free; the full issue is for paid subscribers.

Cosmos Is the Product. Ergo Is Just the Front Door.

Ergo is getting a lot of headlines as the full unification of Art, Emmie, Penny, and Agent Factory is creating the typical Epic unified interoperable EHR soup. My friend and colleague Lyle Berkowitz repeated much of what I’ve been blathering about over the past several years. The real moat ultimately will end up being Cosmos. Other vendors can theoretically create digital workflows, but it would be near impossible for any other vendor to create the knowledge and intelligence system that Cosmos will become. Epic’s 320-million-patient, 23-billion-encounter research database is what will make every other tool in the Epic ecosystem more powerful. Ergo Visit, the pre-appointment prep tool Epic demoed live at Ochsner, pulls straight from it to hand clinicians “Best Care Choices for My Patient” before they walk into the room.

Berkowitz noted that, to most Epic organizations, contributing to Cosmos will stop being optional. The deal was always that you get out of Cosmos in proportion to what you feed it. Until now, Epic organizations have been doing the feeding, but they have gotten very little in return other than an interesting research tool. What’s changed is that Cosmos has stopped being a research curiosity and is being fully embedded into clinical and operational workflows: external content from the likes of UpToDate, with Curiosity’s insight and predictive layer, and the Art/Emmie/Penny/Ergo ecosystem are converging into one environment where a patient, provider, or health system can ask “what does this mean for me?” and get an answer built on the deepest data asset in the industry.

Based on my experience, “Best Care Choices” is still a slow go. I am confident it will eventually be highly functional. Narrowing our clinical focus is the goal. It also has to come with easily understandable reasoning on why it is giving the guidance it is providing.

Whether Epic prices that access sustainably is a separate question. Health systems are being pushed toward “all you can eat” Nebula token plans right now, and that pricing has a good chance of getting a lot less generous once utilization starts burning up GPUs.

Epic Doesn’t Need to Beat Abridge. It Needs to Outlast It.

Joshua Liu calculated some numbers: Abridge costs roughly $138 per clinician per month at scale. Epic can bundle scribe, discharge summaries, and inbox AI into the same ~$100 license health systems already pay for. In other words, Epic can go full Amazon-on-Bezos because it can absorb losses a VC-funded startup can’t sustain indefinitely.

That pricing gap is about to get a stress test. Token costs are part of every one of these AI programs, including Epic’s. “All you can eat” pricing may sound appealing now but once the utilization monster starts chewing, at some point . Ben Tomaszewski’s framework for evaluating startups against Epic’s footprint isn’t about who wins on price today. Does a company build a moat big enough to eat rising token costs before the loss-leader math catches up with it? A documentation-only ambient scribe doesn’t have a moat anymore. The technology is too commoditized now. I had multiple conversations at UGM where health systems are now thinking that they only want to extend Abridge contracts one year at a time. I think that frames the runway question. Content companies like UpToDate have a content moat that Epic can’t cross. The plan is for Cosmos and Curiosity to work alongside UpToDate rather than replace them.

Workflow companies live or die by whether Epic wants to pave over their portion of the last mile. Their best bet is to become a content company that Epic can’t match.

If you don’t know how your organization’s Cosmos contribution ratio stacks up against what Epic’s next AI release will demand, or whether “Best Care Choices for My Patient” is quietly narrowing your clinicians’ judgment without the documentation to back it up, this is exactly the kind of Epic problem I work on.

I run a 30-minute Epic Strategy Review. A working conversation, not a pitch. You describe the specific Epic problem you’re wrestling with, I tell you what I see, and by the end of 30 minutes we land in one of three places: a natural next step, an honest “you don’t need me yet,” or a clean “not a fit.” Book some time here.

John Lee is an emergency physician and Epic consultant who helps health systems bridge the gap between Epic’s capabilities and operational reality. He specializes in data architecture, registry optimization, and making Epic’s tools actually deliver results.

Also on LinkedIn and at hitpeakadvisors.com.is

Read more

🔷 Epic’s UGM AI reveals weren’t about out-innovating ChatGPT, Claude, or OpenEvidence on raw capability. Epic doesn’t need to win that fight. It owns the system of record. It owns integration.

🔷 Epic recognized 89 health systems on its own Honor Roll. Where was the chart chat data from a year ago?

🔷 Nobody at UGM could tell you what Agent Factory will actually cost to run. It saves time…maybe. Has anyone measured that yet?

🔷 Epic’s UGM week is not the only healthcare IT story happening this month. The VA just handed Oracle Health $17 billion more.

🔷 A roundup of MDM vendors pitched for better governance. Yes, they sell the fix. They’re still right.

🔷 CareCloud’s breach count magically inflated by ten compared to the first report. The list of healthcare breaches is never as short as the first headline says.

✅️ Off-Label: A founder’s case for building AI-native businesses that don’t collapse the moment frontier models improve.

The Feed is a quick take on the week’s highest-profile health IT news items, with one piece from outside the beat at the end. The UGM review below is free. The rest of the issue is for paid subscribers.

UGM has dominated the health IT news cycle this week and it dominated my schedule. Hence, I am late. I also couldn’t really find a logical place to insert a paywall so I’m making today’s full newsletter available without a paywall. Enjoy!

The UGM Mini Mega Review

Epic’s UGM AI announcements were not really about shipping new capability. Don’t get me wrong. There were plenty of new features in their Cool Stuff Ahead sessions. But Epic has never been about bleeding edge technology. I described to some colleagues recently that they are slow, fast-followers. You can understand it if you’ve lived it. Their focus is on exploiting its integration superpower. STAT’s Brittany Trang reported that Chart with Art, Chat with Emmie, the Curiosity predictive tool, and a UpToDate content partnership finalized the night before the keynote all lean on the same infrastructural fact: Epic already has the patient record, executes the workflow, and owns the login screen. As a result, the strategy is to keep patients talking to Emmie instead of ChatGPT. Keep clinicians pulling evidence from Curiosity and UpToDate instead of reaching for OpenEvidence. Keep health systems building inside Agent Factory instead of turning to point solutions. None of this requires Epic to out-innovate anyone on the model layer. It requires Epic to keep doing what it already does better than anyone else: own the record and the rails within the record.

An item that attracted my attention was that there seemed to be something missing on a key slide. Epic spoke about heavy use of Anthropic’s restricted Mythos model for internal security work and confirmed it will run Anthropic models in live products going forward. Microsoft, despite hosting all of this on Azure, was nowhere on the AI-infrastructure graphic. Odd, since Microsoft was on stage with its DAX partnership and its keynote appearance just three years ago. Epic also mentioned open-weight models. Put those data points together and we shouldn’t just say that “Epic likes Anthropic now” (although I think they do). They’re clearly hedging across frontier labs, hyperscalers and maybe even open source/open weights rather than betting the roadmap on one partner. They will not have loyalty to a single platform.

Epic also rolled out its own report card of its systems this week. Becker’s summarized that 89 health systems landed on the 2026 Honor Roll and Gold Stars lists. These programs, particularly Gold Stars, are designed to score how well organizations use Epic’s features. Judy Faulkner told the UGM crowd that systems with more stars tend to do better financially, but she was quick to add that the link isn’t necessarily causal. It’s a key hedge, mostly because the logic is a bit circular: Gold Stars only tracks how much you use Epic’s native tools. If you’ve found a better third-party solution for a specific task, Epic’s scorecard effectively ignores it. A well-resourced organization that scores well on Gold Stars may just be well-resourced. That’s a confounding variable, not proof the program works.

Ken Nepple pointed out how this applies in his home organization. He noted that Epic’s native EHR chat that seemed like a no-brainer a year ago is still in limited pilot at just three sites, with very little data to show for it. In fact, some sites are keeping it small rather than scaling. Meanwhile, Nepple’s team has been using a third-party chart-chat tool since early 2024, long before Epic’s version arrived. It’s the classic “grader’s dilemma”: if you set the test and grade it yourself, you’re always going to ace it. Epic’s Gold Stars program would penalize Nepple’s team for skipping their chat feature, despite the fact that the results they are achieving likely exceed any Epic offerings.

Nepple was on a bit of a tear and posted a second poke at Epic. Reviewing two live Agent Factory case studies, he noted the obvious: development of the tool has been a slow process that needs to mature rather than something everyone can plug and play now. The other thing he noted (with the help of a clarification from Taryn Shipley) was that, despite all the Agent Factory hype, even organizations that have Agent Factory tools in place don’t have direct access to the tool. This is actually related to the first point and my slow fast-follower concept. Epic is being very intentional about Agent Factory. They clearly view it as their future and they want to get it right. Finally, he noted what a lot of others I spoke with noted. There is zero quantification of local build cost, personnel time, or ongoing token spend set against the also-unquantified time saved. The reality is that things are just too early. Trying to extrapolate now would be a fool’s errand.

I wrote more on two other UGM threads worth your time if you want a couple additional takes: the room’s actual reaction to the FTC probe and leadership departures, and why Agent Factory’s new connector architecture might structurally defuse the walled-garden complaint that’s followed Epic for years. Both are in my piece from earlier this week.

The VA Just Handed Oracle Health $17 Billion More

While every health IT headline this week pointed at Verona, HIStalk reported that a newly posted federal award notice raised the ceiling on the VA’s Oracle Health EHR Modernization contract by $17 billion, to $27 billion total, up from the original $10 billion signed in 2018. The VA is also seeking a three-year extension to 2031, and three VA facilities in Indiana go live on the Oracle-based system this weekend.

This is a useful reminder that Epic and UGM are not the only things happening in healthcare IT this month. It’s also a study in sunk cost. A program that started at $10 billion and is now authorized for nearly triple that, on a platform with a well-documented rocky implementation history, keeps getting more federal money rather than a hard stop. Once a program of this size and political visibility is underway, the sunk cost pulls harder than the deployment data does. Is anyone really surprised? It’s the federal government.

Industry Vendors Just Validated the Foundation-First Thesis, and Their Own Motives Don’t Change That They’re Right

A Healthcare IT Today roundup pulled quotes from LexisNexis, Documo, CitiusTech, Nordic, Verato, and Cognizant on data governance and master data management in back-office health IT systems. Every one of them said some version of the same thing: automation and AI are only as good as the governed data underneath them, and most organizations don’t have that foundation built. Duh.

Yes, every vendor quoted sells governance or MDM tooling. That potential conflict of interest doesn’t make the underlying point wrong. Self-interested messenger or not, the point needs to get across. The harder problem isn’t convincing people this is important. Nobody serious disagrees. The real problem is that governance work rarely yields a short-term ROI and typically sucks up enormous resources, so it stays underfunded even when everyone nods along. It’s like telling the UN that we need world peace.

However, that economic case is about to get a lot more concrete. Messy, ungoverned data doesn’t just produce mediocre AI outputs. It will produce wildly wrong answers at worst, and token-churning black holes at best. Wrong operational and clinical decisions and massive token bills will probably get CFOs to start paying attention.

CareCloud’s Breach Count Just Grew Tenfold

CareCloud’s March breach, originally reported at 345,000 to 411,000 patients, is now confirmed at 3,756,469. Yes, a factor of ten. Oops.

The mantra from CISOs has shifted from “if” to “when,” and CareCloud’s revision is a reminder of why. Also check the OCR breach portal yourself if you want the fuller list. CareCloud’s number is large but the list is long. Like Thanos said, it is inevitable. Despite this will we see the practical solution of regular downtime drills and real redundancy in data archiving anytime soon? I doubt it.

None of this week’s stories are really about pure technology. Epic’s AI reveals are a story about competitive positioning dressed up as capability. The Honor Roll and the Agent Factory ROI gap are both stories about who gets to grade the test. The VA’s $17 billion is a story about sunk cost outliving deployment data. The MDM roundup is a story about a true thesis delivered by self-interested messengers. And CareCloud is a story about organizations hiding their heads in the sand. Foundation, accountability, and grading who’s doing the grading.

✅️ Off-Label. Not health IT, not my usual lane, but something that made me think. Here’s why it should matter to people who do what we do.

Julie Yoo argues that founders and investors need to build businesses that get stronger as frontier models improve, without becoming structurally dependent on any one of them. It’s a founder’s version of the same concept Epic revealed on the frontier model slide where Anthropic seems to have replaced Microsoft: don’t build your moat on a partner’s roadmap. Any health IT vendor positioning against Epic’s expanding AI footprint should be asking themselves the same question Yoo is asking her portfolio companies.

If your organization is evaluating Epic’s AI roadmap and can’t yet tell which announcements are genuine capability and which are competitive defense, this is exactly the kind of Epic problem I work on.

I run a 30-minute Epic Strategy Review. A working conversation, not a pitch. You describe the specific Epic problem you’re wrestling with, I tell you what I see, and by the end of 30 minutes we land in one of three places: a natural next step, an honest “you don’t need me yet,” or a clean “not a fit.” Book some time here.

John Lee is an emergency physician and Epic consultant who helps health systems bridge the gap between Epic’s capabilities and operational reality. He specializes in data architecture, registry optimization, and making Epic’s tools actually deliver results.

Also on LinkedIn and at hitpeakadvisors.com.

Before I get to what I actually want to talk about, let me get the obligatory content out of the way. As I wrote about earlier this week, STAT reported on two threads: Epic’s non-compete agreements with its own employees and former employees, and whether Epic has used its market position to block rival tech companies from getting at Epic data they need to operate. It’s early. There are also lawsuits that many others have described better than me but they are unresolved and there is no Federal action beyond talking.

The thing I would point out is that I asked people about these controversies all week at UGM. The reality that I encountered was that to the UGM audience, they weren’t really controversies at all. Most hadn’t heard about the news. The ones who had weren’t panicked or even concerned. There were more shoulder shrugs than any emotion. Some were unsurprised but the observation was that market dominance eventually draws federal attention regardless of hard evidence. Given Epic’s seemingly unstoppable steady growth, some would think that the Feds would not be doing their job if they didn’t at least consider it. The leadership changes got a similar reaction. There was curiosity in the room, not alarm. I’m not going to rehash the specifics. Plenty of others already have. I won’t feed the rumor mill.

Here’s my one piece of disclosure before I go further: for those who don’t know, I am firmly in Epic’s camp. I had a conversation this afternoon with someone who is definitely a non Epic person and we discussed how despite any warts, our general agreement is that Epic in sum total has been good for healthcare.

On to the regularly scheduled program. Post-pandemic UGMs have been quite different than the UGMs I attended 15 years ago. Back then, the evening plan was relatively simple: should we do take-out from the Chinese restaurant across the street from the hotel, or drive to a restaurant that somebody recommended? Sometimes, if we were lucky and it was open, we would go to the Ivory Room and listen to dueling piano music. More recently, the evenings are spent trying to figure out which big vendor event to attend and which colleague from across the country I need to meet up with. UGM’s growth has matched Epic’s market reach and delivery of ever increasing volumes of content.

That volume only increased this year. At the executive address, they mentioned how today’s three-month release contains more code than previous years’ 18-month releases. I also think that most people like me have noticed that after they made their web transition, the level of development has increased like compounding interest.

The Keep-Up Problem

This brings me to my first takeaway from the conference. It is a thread Judy herself joked about from the stage. She humorously referenced a running gag about Epic’s history of telling health systems what they need to build one year. And then repeating on the Executive Report then next year. And the next. The room laughed because good humor is always anchored in the truth. Almost everyone is currently trying to deal with an unprecedented volume of new capability. The question that popped into my (and Judy’s) head is whether anyone not named Stanford or an NYU can keep up with the pace of Epic’s development.

The volume itself is a bit of an AI literacy stress test. My observation is that most organizations are failing it quietly, not because the tools aren’t valuable but because nobody on staff has the bandwidth to evaluate dozens of new features a quarter and build a sane, nimble governance process to adopt the handful that will be the biggest bang for the buck.

I’ve been informally polling people on this all year, and I detect a consistent theme: AI literacy inside the average health IT organization is dismal. There is no lack of enthusiasm but the grounding and understanding are lacking. People who can tell you Epic shipped an agent for X have difficulty telling you why, or why X was chosen instead of Y. Layer on a release cadence and volume that’s accelerating and you get exactly what Judy joked about.

Recognizing that UGM is a bit of a skewed population, there was lots of excitement and positive vibes this week but many are also concerned about this volume. I also know plenty of physicians who hate Epic. My strong suspicion, watching this pattern for fifteen years, is that what they actually hate is a poorly implemented Epic. Those are two different perspectives of the same issue. The keep-up problem is the mechanism that turns the second group into the first group’s nightmare: an organization that can’t absorb the platform’s pace ships a worse build, and the physician using that build blames the platform instead of the implementation.

On a related note, Yasir Tarabichi, watched the same keynote and flagged something else. The volume creates governance overhead. To help, Epic created a lot of governance tools such as the new AI governance dashboards, but that doesn’t outsource governance. The dashboards are a starting point, not a substitute. Vendor-supplied visibility still leaves accountability for safety, equity, and performance sitting with the health system. Epic can hand you the pipe. What flows through it is still your problem.

The Connector Argument

Of course, a big highlight was Agent Factory. One additional component that has had a trickle of attention so far that I think will increase is their introduction of connectors such as MCPs. They have made mention that they were thinking about it in previous webinars this year but this is the first time I heard them confirm it explicitly with the most prominent example being UpToDate called out on the stage. It will be available at no additional cost to orgs that already have an UpToDate license. The concept then will be that organizations will be able to infuse UpToDate content into these Agent Factory workflows. Very cool.

There is a second order effect that I think will have an impact beyond the product announcements. Consider that Agent Factory and connectors will allow organizations and vendors intermingle content and data at the speed of vibe coding. That essentially destroys the “walled garden” complaint so many Epic haters have espoused over so many years. Contrast this with the traditional interoperability path using specific API calls that was an exercise in API whack a mole and also tended to make a second app feel like something bolted on. With these connectors, any internal Epic data element will be available to any 3rd party with a connector and the interaction will be governed by the flexibility of the plain English in a markdown document. I’m not sure how you can argue that isn’t interoperable.

Agent Factory and its connectors are still very embryonic but I have yet to see Epic fail on any initiative as big as this. I will also admit that I am not an interoperability or LLM engineer but I would ask that you contemplate this and its effect on potential long term antitrust and information blocking arguments.

What I’m Actually Watching

There were a lot of other announcements and great presentations. I will likely put out a few more pieces of thoughts as I digest things and catch up on my sleep. But these were the two high level themes that I think will be overarching in the Epic world over the next eighteen months. If the keep-up problem doesn’t get solved at the organizational execution level rather than the product level, health systems will own a platform capable of far more than they’ll ever configure correctly. If Agent Factory’s connectors mature the way this week’s demos suggested, the walled-garden argument gets structurally harder to make, and make the FTC pause.

Epic didn’t need to answer the rumors and chatter this week with legal defenses. It answered by the way that it always answers: inexorable, steady development. And as usual, Epic is making working “inside” enticing enough that working “around” isn’t really worth the trouble.

If you’re a vendor trying to figure out how your product will plug into Agent Factory’s connector tiers, this is exactly the kind of Epic problem I work on.

I run a 30-minute Integration Seam Diagnostic. A diagnostic call, not a sales call. You describe how your product isn’t fitting inside Epic, I tell you what I see, and by the end of 30 minutes we land in one of three places: a natural next step, an honest “not right now,” or a clean “not a fit.” Book some time here.

John Lee is an emergency physician and Epic consultant who helps clinical and clinical-adjacent technology vendors close the gap between what their product does and how clinicians actually work inside Epic, so integrations land as native, adopted, and workflow-appropriate rather than as bolt-ons clinicians resent.

Also on LinkedIn and at hitpeakadvisors.com.

🔷 Epic faces an FTC antitrust probe, a leadership vacuum, and its own UGM week at the same time, and plenty of people walking the halls in Verona hadn't heard the FTC story at all.

🔷 Epic turned on real-time prior authorization checks five months early at four health systems. The tight ecosystem everyone calls a walled garden is exactly what made it possible.

🔷 A newsletter writer burned through a week of AI budget in one weekend project. Health systems are about to hit the same wall, just with less visibility into it.

🔷 STAT confirmed the Commure red flags an independent journalist had to remove content twice for reporting first. The lawsuits were the tell, not the defense.

🔷 Patients are handing their primary care to AI before they ever test whether a doctor would fail them. That is not a convenience story anymore.

✅️ Off-Label: A cancer hospital says its landlord flipped a 20-year pricing formula the moment it tried to build a competing hospital. Infrastructure control turns out to matter more than the contract.

The Feed is a quick take on the week's highest-profile health IT news items, with one piece from outside the beat at the end. The two Epic quick hits below are free. The rest of the issue is for paid subscribers.

If you left UGM with more questions than answers about who's actually accountable for Epic's AI roadmap now that half its leadership bench is gone, this is exactly the kind of Epic problem I work on.

I run a 30-minute Epic Strategy Review. A working conversation, not a pitch. You describe the specific Epic problem you're wrestling with, I tell you what I see, and by the end of 30 minutes we land in one of three places: a natural next step, an honest "you don't need me yet," or a clean "not a fit." Book some time here.

John Lee is an emergency physician and Epic consultant who helps health systems bridge the gap between Epic's capabilities and operational reality. He specializes in data architecture, registry optimization, and making Epic's tools actually deliver results.

Also on LinkedIn and at hitpeakadvisors.com.

The Federal Trade Commission is examining Epic Systems for potential antitrust violations tied to how it grants or restricts data access and how it treats former employees under noncompete terms, according to STAT News, which confirmed the inquiry through four sources contacted by investigators. The story broke three days before Epic's Users Group Meeting opened in Verona. I'm sure that was complete coincidence. I'll be up front. I don't know what to make of all this. I don't have any inside information other than what was reported in the STAT News story.

What was most surprising to me, though, was how many people at UGM either didn't know about the story or shoulder-shrugged, "wait, what?" This is not the reaction of a client base panicking and making contingency plans.

I am not going to pretend I have a well-formed take on whether Epic is destined to be in federal antitrust crosshairs. As I've talked to other people who are clued in to the situation, there's a lot of people who are not surprised, but the inquiry is still just talk right now. STAT reports it could run for years without ever producing any legal or regulatory action. There are a lot of people who are watching to see if there is fire behind the smoke, including me.

Whatever happens with the FTC, I think the more immediate question to attendees at UGM is what's happening with the Epic leadership. I certainly will be interested in who is standing on the stage instead of Seth and Sumit this year.

Epic's Walled Garden Just Built Something Nobody Else Could

On the flip side of the antitrust issue, Epic turned on real-time prior authorization checks at four health systems this week: Ochsner Health, Froedtert ThedaCare Health, Denver Health, and Summit Health, running against UnitedHealthcare, Aetna, and Network Health through Epic's new Coverage Requirements Discovery API. Mind you, the CMS deadline for this is actually January 1, 2027, and there are 16 more payers testing.

I think we can call this a win for Epic and a counterweight to the walled garden and antitrust narrative. I strongly suspect that this quick rollout and development was possible because of the tight ecosystem control that Epic gets criticized for constantly.

On the other hand, I looked for a UGM session walking through how well the tool actually performs in practice and didn’t find anything. Of course, this is very early, but ultimately we need to know whether the system works or not.

Meanwhile, Brendan Keeler and friends talked about how difficult of a problem this is to solve. Pryce Ancona, put it this way: "I'm nervous. Everyone who's working in the 0057 space right now is feeling like holy cow, I can't believe folks are going to try to start using this in production on January first." The problem isn't disagreement over whether prior auth needs fixing. There's broad consensus that it does. The underlying foundation, plumbing, clearinghouses, and vendors are a very messy interoperability problem.

I keep talking about foundational and governance issues. I've talked about grouper governance. CMS-0057 is another manifestation of this. There are clearinghouses, utilization management vendors, and all sorts of other players and standards. A single broken link will cause the chain to fail. Epic appears to have solved this problem…maybe.

Read more

🔷 A federal panel just consolidated nine Health Gorilla class actions. Epic’s technical filings become the plaintiffs’ expert testimony against Epic’s own customers.

🔷 Two people built the same Epic Agent Factory agent. The identical output resulted from using 20,000 tokens vs 250,000. Can someone say “token-engineering?”

🔷 Twelve health systems just formed a diagnostic AI consortium with Aidoc, fresh off a $150 million Series E. You might call it governance or you might also call it vendor lock in outside of Epic.

🔷 A new Nature Health study counted 617,827 Copilot health conversations in a month. The peak occurred at midnight. Big tech owns the frictionless night-shift.

🔷 Judy Faulkner explained why Epic is running a second developer conference this fall. Epic is setting the terms for an ecosystem it already controlled but there is a window of opportunity for 3rd parties.

✅️ Off-Label: A healthcare CEO highlights the downside about using ROI to decide nurse staffing.

The Feed is a quick take on the week’s highest-profile health IT news items, with one piece from outside the beat at the end. The two Epic quick hits below are free. The rest of the issue is for paid subscribers.

If you want to start preparing your Epic system to more efficiently use AI when Agent Factory arrives, this is exactly the kind of Epic problem I work on.

I run a 30-minute Epic Strategy Review. A working conversation, not a pitch. You describe the specific Epic problem you’re wrestling with, I tell you what I see, and by the end of 30 minutes we land in one of three places: a natural next step, an honest “you don’t need me yet,” or a clean “not a fit.” Book some time here.

John Lee is an emergency physician and Epic consultant who helps health systems bridge the gap between Epic’s capabilities and operational reality. He specializes in data architecture, registry optimization, and making Epic’s tools actually deliver results.

Also on LinkedIn and at hitpeakadvisors.com.

A judicial panel just centralized nine Health Gorilla data-breach class actions in Miami before a single judge, and signaled it intends to pull Epic’s own fraud suit against Health Gorilla into the same courtroom. Epic sued first, alleging Health Gorilla’s onboarding let bad actors pose as legitimate providers and pull patient records they had no right to. Nine classes of patients are now suing Epic’s own hospital customers over the same breach and will likely use Epic’s own arguments against Epic.

The case will expose Epic’s technical filings describing exactly how the onboarding process failed in the main Health Gorilla case. The problem with that is that evidence will then become expert testimony against the health systems that relied on that process to keep bad actors out (and failed). As notes, there is a needle that can be thread but it will be tight.

The meta issue isn’t Health Gorilla or the class action suit. It’s whether self-attestation is a realistic way to govern interoperability going forward. National exchange frameworks like Carequality and TEFCA run on organizations declaring who they are and what they’re allowed to see. That model works. The incentive to lie also works. “Free flow of data” sounds nice but how do you reconcile that with “protecting health data” if all you need to do is say that you’re a healthcare provider? Will there be an epidemic of Russian hacker (or med mal attorney) boiler rooms saying they are “providers?”

Also, if it appears that I am turning into a Brendan Keeler fan boy, deal with it. You’ll turn into one too if you start reading his stuff.

The Next Hot Skill in the Epic-verse: Token Engineering

At an Epic Agent Factory build session, two people built the identical agent with wildly different token costs. One used 20,000 tokens. The other used 250,000. They had the same output. The difference was driven entirely by how the prompt was written. Once Epic organizations start building agents internally in Chronicles using Agent Factory, that compute cost will start soaring. I’m not sure organizations truly understand the impending budget tsunami that is going to hit them.

Right now, everyone building on these tools is doing it brute force and seeing what sticks. But the tech industry is learning the hard way that there needs to be a better plan. Uber burned through its entire 2026 AI budget on Claude Code in four months earlier this year. Healthcare’s LLM penetration is still embryonic, which means this problem is flying under the radar. It won’t be under the radar for long and organizations need to start thinking about their approach. Token maxing won’t be a good strategy. Token engineering will be.

Just telling people to write tighter prompts is a hope, not a plan. The real opportunity is upstream: tightly governed, well-curated and reusable data assets mean these tools stop churning the same query logic from messy data every time someone asks a question. Health systems that have done the unglamorous work of structuring, curating and governing their data will spend less per agent than the ones treating every interaction as a blank slate. It’s the same underused-foundation problem I keep pounding but with an AI LLM context.

Read more

A patient has a visit with her doctor about her diabetes, obesity and cardiovascular disease. They go through the risks, the side effects, the shared decision-making that’s supposed to happen before a prescription gets written. They decide on Wegovy. The doctor is mindful of the expense, so he tells her to confirm her employer’s plan covers it. She checks and it does. He fills out the usual the prior auth forms, orders it in Epic and sends it electronically to her pharmacy.

She gets to the counter and the pharmacist tells her the claim was denied. She has to pay list price. She walks out without the medication. Two months later, she has a follow-up appointment with her physician, and she has gained 15 lbs. and her A1c has increased. Her physician scratches his head, and the patient explains. Neither of them really understand what happened.

I heard this scenario described while taking a walk a couple days ago on Stacey Richter’s Relentless Healthcare Value podcast. She was interviewing Dr. Suhas Gondi. Stacey’s show has been one of my north stars for years. I often cite it as one of the things that pulled me toward using my IT skills to actually fix healthcare instead of just getting better at gaming it. And I’m good at gaming the system. This particular skill is relevant to this story and I’ll touch on this in a bit.

The self-funded employer in Dr. Gondi’s example did cover Wegovy. What wasn’t apparent to the patient and physician was that the employer decided to route all coverage through a specific third-party vendor that bundles the drug with health coaching and lifestyle counseling. Their decision actually made sense because their claims data showed GLP-1 prescribing only helped if lifestyle modification was coupled with the medication. They wanted a partner ensuring the prescribing and support were delivered in an evidence-based way. It is an expensive medication. They wanted their employee to get the full benefit. From the employer’s perspective, that’s responsible. The problem is that the people who were involved with the prescribing decision (i.e., the patient and the physician) had no idea that it existed. No one knew until the patient hit the pharmacy counter. On top of that, the feedback loop to the physician was the patient returning months later with worse numbers.

Dr. Gondi cited an oncology example a few minutes later. A chemo drug and an appropriate treatment plan were denied not because the drug is inappropriate or didn’t pass a clinical prior auth test. It was denied because the site of care is wrong. Administer it at a hospital-owned infusion center and Gondi says the same medication can carry a 40 percent premium over administering it in a physician’s office or at home. On a single infused biologic dosed repeatedly over a year for one patient, that premium alone can run into tens of thousands of dollars. Multiply it across a health system’s oncology infusion population and the same 40 percent gap compounds into millions of dollars a year, all for the identical drug. The only difference was the room in which it was delivered. The employer adjusted its clinical criteria to steer toward the cheaper site. The workflow friction to the patient and physician had to be manually deciphered.

Gondi and his co-author wrote about this for the New England Journal because he felt most clinicians have a limited understanding of what a self-insured employer even is or does even though they likely are personally insured by one. BCBS is BCBS. Cigna is Cigna. Clinicians typically don’t know the difference between a TPA and TPN.

That knowledge gap stinks but it’s a known issue. From my perspective, the issue that caught my attention wasn’t about physician payor literacy. It was the discussion about why the visibility isn’t seen by the doctor in the first place. Stacey asked Dr. Gondi directly whether Epic would ever put something in the chart pointing a clinician toward a cheaper site of care, something that would actively work against what a hospital system calls network leakage. Gondi pointed out that electronic medical records are primarily “billing instruments,” designed to optimize profit for the customer that pays for them, which is the provider organization. That is not to say that useful clinical information can’t be delivered but clinicians and patients are often left to their own devices to sort through an EMR quagmire that delivers information inefficiently. On top of that, the plan sponsor footing the actual bill most often has no idea where the information pain points are.

It would be easy to write the next few paragraphs as an indictment of Epic and other EMRs. I’ve seen plenty who do but that’s not actually my experience of the people who build it. The engineers, the analysts, the Epic employees I’ve worked alongside over fifteen years overwhelmingly want to do right by patients. I’ve never sat in a room with someone at Epic who was rooting for a patient to get a worse deal or rubbing their hands drooling about making more money for the hospitals. What’s true is narrower and more structural: Epic’s center of gravity is the provider organization that signs the contract, and provider organizations participate in exactly the behavior Gondi is describing. Steering toward the higher-margin site of care isn’t a rogue actor gaming the system. It’s the rational move for whoever’s paying Epic’s invoice. The software reflects the incentive of the entity that funds it. It’s just the reality of how build priorities get set.

I know that dynamic personally, because I’ve facilitated it. Early in my career, before any of the physician-builder identity I write about now, one of my first projects was rigging our note templates to maximize E&M coding. There was nothing deceitful about it. Every element I built into those templates was technically documentable. But the actual work, the actual thought, went into making sure the note hit the bullet points that drove reimbursement, not into making sure the patient’s actual clinical picture was easier for the next clinician to find. There was actually even a vendor whose entire value was to systematically rig the note for billing like this (T-sheets). Readability was never a consideration. I was optimizing for the thing that got measured and paid, the same way the system Gondi describes optimizes for the thing that gets measured and paid. I didn’t think of it as gaming anything at the time. It just felt like doing my job well. It took years, and a fair amount of listening to shows like RHV, to understand that doing the job well and doing right by the patient aren’t necessarily the same thing.

Here’s what makes the GLP-1 example worse than it needs to be: the capability to fix it already exists. Epic’s Interconnect and other interoperability pathways can identify a patient’s payer and detect that a plan is self-insured with specific parameters, the same underlying logic that already powers social-determinants-of-health workflows elsewhere in the build (and are similarly poorly utilized).

The plumbing isn’t hypothetical. It’s the same plumbing used for other cross-domain workflows today. In principle, that same pathway could intercept the prescription before it hits the pharmacy, pend it, route it to the third-party lifestyle vendor the employer contracted with, and require the data points that vendor needs before the script releases.

Nobody builds it, in my experience, because the moment a workflow like this is planned, it stops being simple. There may be an exceptional org that does this but, by and large, Epic organizations like the configuration and workflows to be simple. The moment a build requires pended orders, payer-specific branching logic, and a data contract with an outside vendor, most organizations punt this to the to do list and drift off to the next simpler project. It isn’t because they can’t do it. It’s because the complexity crosses a threshold where attention and interest evaporate before any value gets realized. I’ve written variations of this same observation across my EHR Sutures pieces. It is a different capability with the same pattern: the tool can do a lot and certainly more than almost anyone building on it realizes. But there is often a gap between what’s possible and what’s built.

The oncology example also connects to something I’ve written about before. Epic customers, not other vendors or competing platforms, are what keeps Epic’s incumbency intact. There is a flip side to that. What happens if a provider organization that leans too hard into the higher-margin site of care and leverages Epic tools to rig that game. This isn’t an Epic problem but it is a problem for the patient and the patient’s employer.

On the other hand, what if the self-funded employer eventually gets the data and acts on it. That possibility isn’t theoretical. In 2021, 32BJ, the New York service workers union, had its health fund analysts mine their own claims data and found they were paying NewYork-Presbyterian 358 percent of Medicare rates for the same services other hospitals in the city were billing far less for. The same C-section ranged from seventeen thousand dollars to fifty-five thousand dollars depending on which hospital performed it. 32BJ dropped NYP from its network that January. Three years later, when the union tried to switch third-party administrators, they found out NYP had a most-favored-nation-style contract clause requiring the hospital’s sign-off to be excluded from any plan, and NYP demanded twenty-five million dollars before it would agree. The union stayed with its existing insurer rather than pay it. The Empire Strikes Back.

That last detail is important, probably more than the original prior auth issue. 32BJ built the analyst capacity, mined the claims data, found the leverage and made the call to cut out an expensive provider. Unfortunately, the hidden contract terms were engineered from the start to make that leverage as expensive to use as possible. Information asymmetry isn’t the only wall in this system. Even when an employer does the work Gondi is asking every employer to do, the terms of the game can be gamed through creative contracting.

Unfortunately, 32BJ’s diligence (tragic ending notwithstanding) is the exception, not the rule. Most self-insured employers never ask for this kind of data, and most haven’t built the internal capacity to use it if they got it. The end result of 32BJ’s story puts a bit of a wet blanket on the approach but Gondi’s NEJM piece pushes for awareness on both sides: clinicians understanding employers and employers engaging local providers directly.

I’d add a narrower, more mechanical question that fits in my Epic world view. Is there a pathway for Epic Payer Platform, or something adjacent to it, that could let a self-insured employer request and receive the kind of claims transparency 32BJ had to build from scratch? On top of that, is there a way to then deliver the insights to the point of care so patients and physicians don’t encounter the pharmacy fail in the initial example? I don’t have a confirmed answer but I strongly suspect the capability exists, waiting to be exploited. Somebody would have to build it, want it built, and be willing to live with the complexity once it’s live. If I were advising a self-funded employer right now, this is exactly the kind of thing I’d tell them to ask their broker or TPA about: whether an Epic Payer Platform license, or something like it, is even on the table. Most never ask, because most don’t know a tool like that exists and most don’t think about leveraging data like 32BJ did.

Gondi’s closing point is that both giants, employers and clinicians, are asleep to each other’s constraints, and the patient absorbs the pain. The IT story and opportunity behind this is that the software both giants live inside of isn’t neutral ground. It’s built by, funded by, and answerable to the provider organization, and it will keep optimizing for the megasystems until someone with the leverage to change the incentive shows up and uses it. 32BJ found that leverage once. They weren’t able to fully leverage it but I think other employers should keep trying.

If your organization has ever configured a workflow around what’s simple to build rather than what actually closes the gap between what a payer knows and what a clinician sees, this is exactly the kind of Epic problem I work on.

I run a 30-minute Epic Strategy Review. A working conversation, not a pitch. You describe the specific Epic problem you’re wrestling with, I tell you what I see, and by the end of 30 minutes we land in one of three places: a natural next step, an honest “you don’t need me yet,” or a clean “not a fit.” Book some time here.

John Lee is an emergency physician and Epic consultant who helps health systems bridge the gap between Epic’s capabilities and operational reality. He specializes in data architecture, registry optimization, and making Epic’s tools actually deliver results.

Also on LinkedIn and at hitpeakadvisors.com.

🔷 Brendan Keeler reread (or at least his tool did) 2.6 million words of scrubbed federal transcripts and found Judy Faulkner lost nearly every argument she made against Meaningful Use. Epic didn’t capture the regulators. It adapted to them better than anyone else in the room.

🔷 A survey of 112 Epic-shop leaders finds 71% call themselves Epic-first and 91% trust Epic’s AI roadmap even mid-exodus of its own AI leadership. Epic doesn’t need to win on features. It needs to be good enough while its semantic data does the winning underneath.

🔷 A Yale associate dean is warning that AI scribes could rob medical students of the cognitive work note-writing was always supposed to install. The real question isn’t whether scribes help. It’s why anyone thought the note was ever just a document.

🔷 Four health systems, four Epic price tags between $40 million and $175 million, and only one of them chose to renovate instead of replace. Cone Health’s bet says something about what happens when informatics stops being a cost center and starts being the mission.

🔷 A former ENT surgeon argues AI is diminishing what little autonomy physicians have left. She’s not wrong about the mechanism. She’s describing the faster horse, not the innovation to make it obsolete.

✅️ Off-Label: Cassie Kozyrkov’s monthly AI roundup found that trusting AI advice drops human “I don’t know” responses from 36% to 6%, even as the AI’s own accuracy falls. Confidence turns out to be contagious. So is the incompetence underneath it.

The Feed is a quick take on the week’s highest-profile health IT news items, with one piece from outside the beat at the end. The two Epic quick hits below are free. The rest of the issue is for paid subscribers.

Most health systems can name what Epic does well. Few can say whether their own build discipline would survive the same twenty-year test Epic just passed. If yours can’t, this is exactly the kind of Epic problem I work on.

I run a 30-minute Epic Strategy Review. A working conversation, not a pitch. You describe the specific Epic problem you’re wrestling with, I tell you what I see, and by the end of 30 minutes we land in one of three places: a natural next step, an honest “you don’t need me yet,” or a clean “not a fit.” Book some time here.

John Lee is an emergency physician and Epic consultant who helps health systems bridge the gap between Epic’s capabilities and operational reality. He specializes in data architecture, registry optimization, and making Epic’s tools actually deliver results.

Also on LinkedIn and at hitpeakadvisors.com.

Judy Faulkner spoke at nearly every meeting of the HIT Policy Committee for six years running. She lost a lot of arguments. Actually almost all of them.

That is not spin. That is what the transcripts actually say. Meaningful Use is not exactly front-of-mind anymore. Most of the industry stopped ruminating about it years ago and moved on to the AI hype de jour. The committee’s public record, 2.6 million words of it, quietly disappeared from the federal archive when ONC refreshed its site. Brendan Keeler, being the genius masochist he is, rebuilt it, and did the industry a real service doing it. Check it out if you want to inflict some transitive masochism on yourself. If you’d rather see his TLDR, this is what he found: Faulkner accounts for 2.5 percent of the total word count across six years. On the specific fights she showed up for, she lost more often than she won.

The popular version by the numerous Epic-haters out there is that Faulkner worked the committees, Congress, and CMS, quietly bending the rulebook toward Chronicles while nobody was paying attention. The transcripts do not support that story. What they support is duller. Her tone across the transcripts became increasingly defensive. Toward the end, they were closer to resignation than Wormtongue working Theoden.

I wrote about some of the results of this dynamic in the spring. Epic’s competitors did not lose because Epic out-lobbied them. Allscripts bought Eclipsys. Cerner bought Siemens Health Services and half a dozen other companies. Both bets assumed the way to compete with an integrated platform was to buy what they called integration. But true integration can’t be bought. What Epic’s competitors built instead was technical debt at a scale it took years to fully appreciate. They had applications under one brand but the codebases and data models were mismatched. Epic’s integration strategy was inexorable internal R&D. This looks like somewhere between thirty and fifty percent of revenue compounding for two decades. Oracle’s healthcare R&D gets diluted inside a corporate budget that also funds NetSuite and Fusion ERP. Altera runs at fourteen percent R&D intensity as one line item inside a five-hundred-subsidiary acquire-and-optimize portfolio.

Put those two stories next to each other and you get the last decade of EHR competition. Faulkner was not the loudest voice in the room, and by the committee’s own transcript, she was frequently the losing one. Anyone who has been in a room where she speaks knows that she does not command the room like a Jonathan Bush or Glen Tullman. Her operating theory, and Epic’s, has always been to let the software do the talking. Call it regulatory capture if the simpler story is the one you want. What actually happened is that Epic adapted to the rules better than its competition did. Their competition was busy making acquisitions that made more press than progress.

Epic’s Real Moat Isn’t a Feature. It’s Semantic Data Nobody Else Has

A new survey of 112 senior leaders at Epic-based health systems, run by Redesign Health, puts numbers on something most of us already felt. Seventy-one percent describe their organization as Epic-first. Eighty percent of those executives expect that bias to intensify over the next three to five years. Ninety-one percent report complete or significant confidence that Epic will execute on its AI roadmap to match best-in-class outside solutions, in the same stretch of months that saw Epic’s president and its head of AI both walk out the door.

James Griffin, CEO of Invene, extrapolated this narrative. Outside vendors are not competing against a specific Epic feature. They are competing against the cost and complexity of adding a vendor at all. Forty-nine percent of the leaders surveyed said an outside product has to deliver significantly higher ROI than Epic’s built-in version just to get a hearing.

I laid out the four lanes where a third party can actually win against that gravity back in the spring: workflows Epic does not own, data Epic cannot reach, clinical content Epic will not build, and speed against a backlog Epic will not prioritize. Every one of those lanes are still valid. What this survey adds is a reminder of what Epic is actually competing on. FHIR and USCDI set a floor for structured interoperability with granular, atomic data. That is real progress but it is still a floor. The overwhelming majority of the semantic, contextual, longitudinal data that makes healthcare operate and move sits way above that floor. These semantics are not covered by any standard. Within an Epic centric world, those semantics, schema and definitions belong to Epic. Epic does not need to be the best AI vendor in health IT. It needs to be good enough, sitting on top of data nobody else can assemble, and let that gap widen every quarter Cosmos collects more data and Curiosity gets smarter.

Read more

Delivering healthcare is hard. EHRs have inflicted a death by a thousand cuts. These pieces are the sutures.

Part 1 covered how two sepsis order sets, built years apart by people who never spoke, quietly produced two different standards of sepsis care in the same emergency department, and how tagging the library exposed three more dormant order sets sitting one accidental favorite away from becoming the same problem again. This piece picks up where that one left off.

When Sepsis’s Turn on the Staircase Actually Arrives

The value of bucketing isn’t only that it catches conflicts. It’s who ends up in the room when it does. When the sepsis bucket comes up for its scheduled review, the roundtable isn’t just physicians. Pharmacy is there for antibiotic selection and timing. Nursing is there for the reassessment workflow that actually happens at the bedside. Administration is there for the SEP-1 reporting burden. Because every sepsis-tagged order set surfaces at once, sepsis stops being five separate projects run by five separate committees. Instead, it becomes one conversation, with all the stakeholders discussing all the related content simultaneously, instead of whatever order sets somebody’s pet project happened to spin off that quarter.

It is also a different meeting than the one that built either original order set. Nobody in the room is defending a build they personally championed years ago. The physicians who championed Sepsis Bundle — ED and Sepsis / Septic Shock — Adult are both gone. What the group is looking at instead is two active order sets, multiple dormant ones, and a SlicerDicer report showing exactly how the two active sets have been quietly producing two different standards of sepsis care. Nobody needs to be talked into treating this as a problem. The dormant sets get retired outright. For the two active ones, the group doesn’t split the difference and doesn’t pick a winner. They consolidate to a single order set, built once, by the people who actually touch a sepsis patient across the entire encounter rather than by whichever service line happened to file the ticket first.

The consolidation goes past fluids and reassessment timing. The group standardizes antibiotic selection, and, more consequentially, builds a discrete field for the clinical reasoning behind any deviation from a full-volume bolus: cardiorenal risk, early pressor initiation, whatever the clinical picture calls for. That reasoning used to live, if it lived anywhere, in a free-text note a quality abstractor had to read manually to decide whether a lower-volume bolus was a lapse or a documented exception. Discrete data means SEP-1 compliance and exception review can run off a report instead of off chart review, at scale, without anyone reading a note to find out why a physician did what they did.

The outcome gap that opened Part 1 disappears. One sepsis order set serves the emergency department and inpatient now, built against a single, current, cross-disciplinary standard instead of two disconnected ones. The SEP-1 and length-of-stay disparity between Physician A and Physician B narrows to noise.

Tell requestors the truth about the timeline. The part of this that takes actual institutional discipline is what happens when a department wants their order set updated now. The answer, under a bucketed model, is sometimes “that domain isn’t scheduled again until 2030.” That is not a popular thing to say to a service line chief who is convinced their request is urgent. But the alternative, the ungoverned status quo, produces exactly the failure mode that opened Part 1: two well-intentioned builds, never reconciled, quietly producing different standards of care along with others sitting dormant like landmines waiting to wreak havoc. A defined escalation pathway still exists for genuine safety issues. Everything else waits its turn, and requestors are told exactly when their turn is, instead of disappearing into an unbounded queue where, in practice, many requests are simply never done at all.

The Number That Made This Worth Doing at Scale

Sepsis was the proof of concept, not the destination. Once the bucketed review process was running, it didn’t stay confined to one clinical domain. Neuro’s turn came. Then anesthesia. Then general medicine, cardiology, and the rest of the staircase, one scheduled domain at a time, the same freeze-then-organize-then-bucket sequence sepsis had gone through, run on a fixed cadence instead of reinvented from scratch each time.

Two years in, the order set library that opened Part 1 at nearly 1,000 records stood at 350. Every domain that came up for review found its own version of the sepsis pair: duplicates built by committees that never spoke, dormant sets nobody had gotten around to retiring, order sets built for programs that no longer existed. Bucketing didn’t just catch sepsis. It caught the same failure mode everywhere it had been quietly accumulating for a decade.

The library shrinking isn’t the interesting number. Multiple quality metrics moved with it, and order set utilization increased. Physicians used the governed order set instead of building a personal workaround or defaulting to whatever their favorites list happened to hand them, because the governed version was now the one that actually reflected current practice.

And the same SlicerDicer order friction model the ED director had used to crack the sepsis case, run across the whole library two years later, turned up something nobody had specifically set out to measure. Time in order, the friction between opening an order set and completing it, dropped substantially across the board. For orders built from a governed order set specifically, time in order fell under two seconds.

That’s the actual case for doing this at scale, and it isn’t the one most governance pitches lead with. The case isn’t that governance catches conflicts, though it does. It’s that a library people can navigate quickly is a library people actually use as built, instead of routing around it with favorites, workarounds, and whatever happens to load fastest at 3 a.m. Ad hoc governance discovers conflicts by accident, usually after an outcome gap has already accumulated, like the sepsis example. Bucketed governance discovers them by design and, it turns out, makes the whole system faster to use in the process.

So What

The dollar-and-outcome version of this is straightforward. SEP-1 compliance is a CMS-tracked measure with real reimbursement exposure. Sepsis length of stay compounds across every bed-day the hospital is carrying a patient who could have been discharged sooner under a more consistent protocol. Sub-two-second time in order, multiplied across a two-year rollout and every domain on the staircase, is the kind of number that never makes a quality slide but shows up in every physician’s shift regardless. But the better number is still the one that’s harder to put in a slide: how many other order sets, right now, in your build, are quietly doing what the sepsis pair did for eighteen months, producing two standards of care under one roof because two tickets got processed by two analysts who never had a reason to talk to each other, and how many more turn up the moment somebody actually looks.

This is the third time this series has landed on the same underlying diagnosis at a different layer of the Epic build. The OPA piece found it in alert governance. The grouper piece found it in cohort definitions. This piece finds it in order sets, and finds that fixing it at scale pays for itself in more than just avoided outcome gaps. The pattern is not a coincidence, and it is not specific to any one content type. It is what happens anywhere Epic lets multiple people build independently against the same clinical concept, with no metadata architecture forcing those builds into the same room before a patient ends up on the wrong side of the divergence.

If nobody in your organization can tell you which sepsis order set — or any order set — your physicians actually default to, and why, this is exactly the kind of Epic problem I work on.

I run a 30-minute Epic Strategy Review. A working conversation, not a pitch. You describe the specific Epic problem you’re wrestling with, I tell you what I see, and by the end of 30 minutes we land in one of three places: a natural next step, an honest “you don’t need me yet,” or a clean “not a fit.” Book some time here.

John Lee is an emergency physician and Epic consultant who helps health systems bridge the gap between Epic’s capabilities and operational reality. He specializes in data architecture, registry optimization, and making Epic’s tools actually deliver results.

Also on LinkedIn and at hitpeakadvisors.com.

🔷 Epic’s real AI advantage in the Advocate Health and ECU Health agent deployments is that the model and the workflow live in the same place, which means a more functional human-in-the-loop dial.

🔷 Wisconsin just made Epic its statewide interoperability layer with federal rural health dollars. Epic already held that position by market share alone. The agreement just makes it official and fills in the gaps.

🔷 Optum folded Claude into a $3 billion claims and revenue push, and the design detail everyone’s skipping is what happens when payer AI grades provider AI that it wrote.

🔷 A physician turned off his AI scribe for his hardest patients. Hard patients make you think and writing is thinking.

🔷 A federal judge just ruled hospitals can’t hide behind Oracle’s BAA when a breach happens. This is a problem for any provider using an EMR.

✅️ Off-Label: An AI detector flagged a physics thesis written years before ChatGPT existed as 70% AI-generated. The unfalsifiable-verdict problem showing up in academia is the same ground-truth problem showing up in your chart.

The Feed is a quick take on the week’s highest-profile health IT news items, plus one piece from outside the beat at the end. The two Epic quick hits below are free. The rest of the issue is for paid subscribers.

I will be taking a bit of a break next week to help with a go live. Be back on the same Bat channel on August 10.

If your organization is watching Epic’s leadership headlines for signal while your own agentic AI validation step has quietly stopped catching anything, you’re worried about the wrong instability — this is exactly the kind of Epic problem I work on.

I run a 30-minute Epic Strategy Review. A working conversation, not a pitch. You describe the specific Epic problem you’re wrestling with, I tell you what I see, and by the end of 30 minutes we land in one of three places: a natural next step, an honest “you don’t need me yet,” or a clean “not a fit.” Book some time here.

John Lee is an emergency physician and Epic consultant who helps health systems bridge the gap between Epic’s capabilities and operational reality. He specializes in data architecture, registry optimization, and making Epic’s tools actually deliver results.

Also on LinkedIn and at hitpeakadvisors.com.

Advocate Health and ECU Health are deploying test cases using Epic’s Agent Factory platform. Advocate Health is running AI agents inside pharmacy and infusion-prep workflows. ECU Health is running them on transfer and discharge planning. There are a few angles that pop out to me.

A key feature of Epic’s M.O. in these agent tech platforms is that they structurally design a “human in the loop.” The human in the loop is, in my opinion, a bit overused and tired, but it is an important concept to call out. There is no discrete border between fully autonomous and human in the loop. Human-in-the-loop is a dial, not a switch. What makes this unique in Epic is that the AI sits fully inside the native workflow instead of bolted on as an external layer, which lets Advocate and ECU Health turn autonomy up or down without the work feeling stitched together. A third-party tool doing the same thing has far less control.

One thing to note is that native integration is better, but it does not eliminate risk. It moves it. The biggest risk is automation bias. What happens to a workflow after six months of the tool always being right? If a validation step surfaces information but never produces a rejection, is that effectively full automation?

Finally, neither infusion prep nor discharge planning are the redesigns our healthcare system needs. Both are a faster version of a workflow that already existed, on a factory floor nobody has redesigned. The industry keeps mistaking a faster horse for a new vehicle. Epic’s workflows are still a faster horse, just with more seamless UI.

Wisconsin Just Made Epic Its Statewide Interoperability Layer. That Was Already Mostly True.

Wisconsin’s Department of Health Services confirmed to Becker’s it has selected Epic to build a statewide electronic health record system, Becker’s Hospital Review reported, funded through the federal Rural Health Transformation Program. Wisconsin was awarded roughly $203.7 million under that program. DHS said it could not share additional specifics because the contract is still being negotiated.

Even without knowing details, this is a genuine public-interest case. Data still does not flow cleanly between organizations, and a single statewide record helps close that gap in a way piecemeal interoperability standards have not managed to. Epic already holds something close to this position across Wisconsin’s provider landscape by market share alone. This agreement does not create that dominance. It formalizes and reinforces it with governmental blessing.

The harder question is the one so many are asking now. Is it wise for that much of a public’s clinical infrastructure to run through one vendor’s semantic and operational model of care? That is not a Wisconsin question. It is the same concentration question every Epic-heavy area (ie: almost everyone) is thinking about. The alternative, real multi-vendor semantic interoperability, is still spinning its wheels. Wisconsin just added to controversy.

Read more

Delivering healthcare is hard. EHRs have inflicted a death by a thousand cuts. These pieces are the sutures.

Two physicians work the same emergency department. Both treat sepsis constantly. Both are good at their jobs. And for eighteen months, one of them has been quietly outperforming the other on every sepsis quality metric the hospital tracks: SEP-1 bundle compliance, and sepsis-specific length of stay. Nobody noticed, because nobody was looking at performance patterns and connecting them to ordering patterns per physician. They were looking at department-level compliance, which averaged out fine.

The explanation, when someone finally went looking for it, had nothing to do with clinical judgment. It had to do with which order set each physician had favorited years ago and never revisited. Physician A had favorited Sepsis Bundle — ED back when it was the only sepsis order set in the build, and it had sat at the top of her preference list ever since. Physician B had favorited Sepsis / Septic Shock — Adult, the generic set the hospitalists and intensivists had built for use across any unit, and it surfaced first every time he searched. Neither physician was weighing two options each shift. Each was clicking whichever one their own favorites list had already decided for them, months or years before this particular patient existed.

Two Order Sets, Built Years Apart, By People Who Never Spoke

The emergency department has an order set called Sepsis Bundle — ED. It was built years ago by the ED’s sepsis committee: a 30 mL/kg crystalloid bolus, a fixed reassessment window, a lactate-clearance protocol that reflected the guidance available at the time. The physician who championed it left the organization two years ago. The analyst who built it moved to a different team not long after. The order set is still live. Nobody currently employed owns it.

Somewhere in the same build, hospital medicine and critical care ticketed a second order set: Sepsis / Septic Shock — Adult. Newer, built by a different committee, reflecting an updated approach to fluid resuscitation for a subset of patients at cardiorenal risk, with earlier consideration of vasopressor support. A different physician champion, a different analyst, a different ticket queue. That group of people had also left the organization. Nobody checked whether an ED-originated sepsis order set already existed before this one was built. Why would they? The request came in as “we need a sepsis order set for our service line,” and analysts process the ticket in front of them, not the ticket that might already be sitting in someone else’s build from three years ago.

Both order sets are reasonable. Both reflect real clinical reasoning current at the time they were built. Neither is wrong in isolation. The problem is that Epic will surface both of them to any physician who searches “sepsis” at 3 a.m., and nothing in the build tells that physician which one applies to the patient in front of them. So the choice comes down to whichever one a physician favorited once, early in their time at the organization, and never had a reason to reconsider. Favorites lists are sticky by design. Nobody audits their own. Once an order set lands there, it stays there until something forces a second look, and for most physicians nothing ever does.

So what? Two physicians, treating clinically similar patients, converge on two different fluid strategies and two different reassessment cadences, not because their judgment differs but because their EMR search history differs.

Finding the Pattern Nobody Was Looking For

The disparity surfaced through routine quality reporting, not a special investigation. Physician A’s patients were less likely to hit the full SEP-1 bundle within the window. Physician A’s sepsis length of stay ran longer. Physician B’s numbers were consistently better. The instinct in most organizations at this point is to treat it as a performance conversation. Pull Physician A aside, review a few charts, maybe flag it for peer review.

That instinct is wrong here, and proving it wrong is the actual finding. The ED director didn’t wait on a report from analytics. She opened SlicerDicer herself, the way it’s designed to be used, and split sepsis order volume by ordering physician instead of by department, then overlaid it against which order set each physician actually opened. The pattern explained itself. Physician A defaults to Sepsis Bundle — ED almost every time. Physician B defaults to Sepsis / Septic Shock — Adult. The outcome gap wasn’t a competence gap. It was two different builds producing two different care pathways, running silently in parallel, never reconciled, never audited against each other.

This is the moment every EHR Sutures piece in this series keeps arriving at from a different direction. The OPA governance piece found it in alert override data nobody reviewed after go-live. The grouper piece found it in cohort definitions that quietly diverged between Chronicles and Clarity. Here it shows up a layer closer to the bedside: two order sets, each internally coherent, each institutionally orphaned, producing two different standards of care under the same roof. The foundation problem doesn’t live in one place. It recurs at every layer of the build where governance was assumed rather than assigned.

Why This Keeps Happening

Ask the obvious question. Why didn’t anyone catch this at build time? Because nothing in the ticket queue told the second analyst that a sepsis order set already existed. Because order sets get requested, scoped, and built at the ticket level, and the ticket level has no visibility into the rest of the library. Because the reflex, every time a new initiative lands, is to build something new rather than ask whether something close enough already exists and needs updating instead. There was no process or culture that systematically made the pause systematic. This is the same build-versus-change failure mode this series keeps returning to. Building is satisfying. It ships. It closes a ticket. Reconciling two builds against each other is slower, less visible, and belongs to nobody’s job description.

The reason it goes undetected for so long is that most organizations don’t have a governance body chartered to look for exactly this pattern. Usage analytics exist and are easily accessible. Reporting Workbench and SlicerDicer can show you order set volume by department, by provider, by frequency. You don’t need to navigate a SQL query queue. The tooling was never the gap. The gap was that nobody was assigned to look, and even if they had looked, there was no process to act on what they found. The operational value was assigned to producing the order sets, not making sure the order sets were governed. I return to the Navy SEAL mantra: “Slow is smooth. Smooth is fast.”

The Fix: Governance That Bundles Instead of Triages

The organization that eventually solved this didn’t solve it individual order set by order set. They solved it by changing how order sets get governed, and the redesign is worth walking through because the mechanism generalizes to every content type this series has covered.

Step one: freeze, then organize. Before anything else, the organization froze new order set requests, with exactly three carve-outs: patient safety, regulatory compliance, and genuinely critical operational issues. The freeze comes first because you cannot catalogue a library that is still changing underfoot. Every request that lands mid-effort is one more record without a bucket assignment, undoing the point of the exercise before it starts.

With the library held still, the actual organizing could happen. Before the organization could clean up nearly 1,000 order sets, it had to see them, all at once, in a form that made comparison possible. That meant a metadata record for every order set: owning specialty, clinical domain bucket, review cycle date, linked reviewer panel. Not a consolidation effort yet. A cataloguing effort. Nobody was retiring anything at this stage, just tagging every record so the library could finally be queried instead of just searched. Once every order set carries a bucket assignment, the inconsistencies and overlaps stop hiding. A sepsis order set built by the ED and a sepsis order set built by hospital medicine, both tagged to the same clinical domain, now sit in the same query result instead of three specialties apart in an unlabeled pile.

Step two: bucket, don’t triage. This is the part that actually would have caught the sepsis conflict, and it’s the part most organizations skip, even the ones that do the tagging work in step one and stop there. Once the freeze lifts, order set requests don’t get processed first-in-first-out, and they don’t get prioritized by whichever requestor is loudest or most persistent. They get pulled by the bucket assignment from step one, specialty and clinical domain, and each bucket moves through the same staircase: review, build, validate, go live. Neuro this quarter. Anesthesia next. General medicine after that. Every domain comes back up for review roughly every three years, whether or not anyone requested it, which means content drift, and duplication like the sepsis pair, gets caught on a schedule instead of by accident.

Here’s the piece that connects back to the grouper piece specifically. The metadata record architecture from step one is the same architecture that governs which diagnosis grouper is canonical. The same property field structure that tags a grouper record with its governance owner and review cadence tags an order set record with its clinical domain bucket. When Neuro comes up for its three-year review, every order set tagged to that bucket surfaces together, not because someone remembered to check, but because the metadata record makes the query trivial. The sepsis pair would have surfaced in the same bucketed review the moment both records were tagged, long before an outcome disparity had to be discovered by accident in SlicerDicer.

The bucket tag was the easy part. What it surfaced was worse than two order sets. The ED director ran the same SlicerDicer order friction model against the sepsis bucket that had cracked the original case, and it turned up a handful of other order sets nobody had thought to check against Sepsis Bundle — ED or Sepsis / Septic Shock — Adult: a sepsis-adjacent set built for a since-closed observation unit, a duplicate someone had cloned and half-renamed during a prior EHR optimization sprint, an order set built for a research protocol that never launched. None of them had been ordered in months. Some hadn’t been ordered in years. All of them were still active, still searchable, still one favorite-click away from becoming someone’s default.

That’s the compounding risk hiding in plain sight. Nothing stops a physician from stumbling onto one of these during a busy shift, favoriting it because it showed up in a search and looked plausible enough, and quietly adopting content nobody has reviewed since before the physician who champions it left the building, or in some cases since before the department that requested it still existed. It would be the same failure mode that produced the sepsis pair, except worse. Sepsis Bundle — ED and Sepsis / Septic Shock — Adult were at least built against real clinical reasoning at the time. These were abandoned before anyone had the chance to argue about whether they were right, sitting dormant and unreviewed, waiting for exactly the kind of accidental favoriting that started this whole story.

The tagging exposed a bigger mess than anyone had budgeted for, and the freeze couldn’t hold forever. What actually happened when the sepsis bucket came up for its scheduled review, and what changed everywhere else in the build once this hospital ran the same process on purpose, at scale, for two years, is Part 2. Stay tuned…

If your order set library has content nobody currently owns, still live, still searchable, and one accidental favorite away from becoming somebody’s default, this is exactly the kind of Epic problem I work on.

I run a 30-minute Epic Strategy Review. A working conversation, not a pitch. You describe the specific Epic problem you’re wrestling with, I tell you what I see, and by the end of 30 minutes we land in one of three places: a natural next step, an honest “you don’t need me yet,” or a clean “not a fit.” Book some time here.

John Lee is an emergency physician and Epic consultant who helps health systems bridge the gap between Epic’s capabilities and operational reality. He specializes in data architecture, registry optimization, and making Epic’s tools actually deliver results.

Also on LinkedIn and at hitpeakadvisors.com.

🔷 Abridge just acquihired an automation company. Which of the four-lanes for surviving an Epic-centric market are they going to leverage?

🔷 The White House just told HHS and NIH to prioritize AI in FY2028 budgets, and Epic’s Cosmos platform is already sitting where the federal money wants everyone else to be in five years.

🔷 ChatGPT Health just launched to every adult in America, and Epic’s answer isn’t a smarter model. It’s that Emmie already knows your chart.

🔷 CMS wants to ban outsourced RPM vendors, and the real effect isn’t fraud prevention. It’s forcing point solutions to live inside Epic or die.

🔷 Seven health system CIOs just admitted, on the record, that nobody owns an AI tool once it goes live. That’s not a monitoring gap. That’s the whole governance model.

✅️ Off-Label: A newsletter writer used AI to write a book about using AI. The real lesson isn’t about the book. It’s about which fifteen minutes AI actually saves you, and which ones it just moves.

The Feed is a quick take on the week’s highest-profile health IT news, plus one piece from outside the beat at the end. The two Epic quick hits below are free. The rest of the issue, including the CIO piece on AI monitoring, is for paid subscribers.

If your organization is quietly widening its AI vendor relationships every time a point solution announces a platform expansion, without ever re-running the question of which lane that vendor is actually filling, this is exactly the kind of Epic problem I work on.

I run a 30-minute Epic Strategy Review. A working conversation, not a pitch. You describe the specific Epic problem you’re wrestling with, I tell you what I see, and by the end of 30 minutes we land in one of three places: a natural next step, an honest “you don’t need me yet,” or a clean “not a fit.” Book some time here.

John Lee is an emergency physician and Epic consultant who helps health systems bridge the gap between Epic’s capabilities and operational reality. He specializes in data architecture, registry optimization, and making Epic’s tools actually deliver results.

Also on LinkedIn and at hitpeakadvisors.com.

Abridge just acquihired an automation company. [Disclosure: I consult for Abridge. I have no inside knowledge of this transaction or the development effort behind it. Everything below is built from what’s public.]

The four-lane framework I have called out for third-party survival in an Epic-centric market says a vendor expansion should strengthen one of four lanes: a workflow Epic doesn’t own, data Epic can’t reach, external content Epic can’t produce, or speed Epic can’t match. An acquihire is harder to read against that framework, because it isn’t a specific capability announcement. It’s a company deciding the fastest way to get somewhere is to buy the people who already know how.

Abridge’s own announcement and Fierce Healthcare’s coverage both tell the same story before this week’s acquihire even happened. Abridge started eight years ago as an ambient documentation tool. It is now positioning itself as a platform spanning real-time claims adjudication, life sciences trial screening, nursing documentation, and smart-room integration, backed by an NVIDIA foundation model and an Eli Lilly investment. I recently participated in an Abridge hackathon, and ambient documentation, the company’s original product, was barely mentioned. The room was building somewhere else entirely.

That’s the tell. When a company built its name on one workflow and then spends a hackathon not talking about it, the acquihire isn’t expanding a strength. It’s patching whichever lane the internal roadmap decided it couldn’t build fast enough on its own. ’s take is, as usual, highly enlightening. The TLDR quote from his piece is “Abridge just paid up for is people who know how to make a browser click the right button four hundred times without breaking.” Health systems evaluating Abridge, or any vendor mid-pivot like this, should ask the question the press release won’t answer: which of the four lanes just got easier for them, and which one did they just admit they couldn’t do alone?

Epic’s Cosmos Is Already Where the Federal Money Wants Everyone Else to Be

The White House ordered HHS and NIH to realign FY2028 R&D budgets around nine priority areas, AI and foundational biological science at the top, with a 90-day clock for agencies to submit implementation plans. The Genesis Mission framing explicitly calls for combining longitudinal health cohort data with supercomputing to find disease origins, which is structurally the same bet Epic made with Cosmos years ago.

Having worked inside the platform, Cosmos still has real work ahead of it, but it’s also more developed and semantically richer than any comparable real-world dataset on the market. I’ll own that I’m not a neutral observer here. The deeper problem the directive doesn’t solve is that FHIR and USCDI create a definitional floor for how data moves, not a semantically rich asset for what it means. Getting past that floor requires assets like specialty registry taxonomies to be in the public domain. These are semantically rich taxonomies that specialty societies have historically kept locked down. One exception is Epic’s registry agreement with the American College of Surgeons. This is the kind of move that has to happen at scale, specialty after specialty, before this federal ambition has anything real to run on.

Any health system whose research strategy already runs through Cosmos and FHIR-based exchange should read this directive as validation of a bet made years ago. Any system without that foundation should not expect ninety days to be enough time to build one.

ChatGPT Isn’t Trying to Out-Think Epic. It’s Trying to Out-Reach It

OpenAI launched ChatGPT Health to every logged-in U.S. adult this week, letting anyone connect Apple Health, hospital records, and lab results to a general-purpose model that will now answer questions about their own chart. The launch landed one day after a Florida lawsuit alleging ChatGPT told a family member their pulmonary embolism symptoms weren’t dangerous and talked them out of seeing a doctor. Robert Wachter’s read frames this as a liability question. It is, but the liability question and the ground truth question are the same question wearing different clothes. If you have a reliable audit trail and a defensible account of what the model actually knew, you have most of your legal protection already built. The problem is that medicine’s own ground truth is shakier than the industry likes to admit, a case I’ve made in detail elsewhere, and an audit trail built on shaky ground truth doesn’t hold up any better than the ground truth does.

Epic isn’t trying to win this fight by out-computing ChatGPT. It’s trying to win by already having the context ChatGPT has to ask the patient to go fetch. Emmie, Epic’s own patient-facing AI layer inside MyChart, starts from the record instead of a connected app the patient has to configure first. Anyone who has actually used frontier models has seen how context beats algorithm almost every time. ChatGPT may out-horsepower Epic on raw model capability. But Epic has the chart, the workflow, and the HIPAA cover a compliance office trusts in a way a consumer AI company currently can’t match. Once Emmie clears a basic bar of usefulness, it’s hard to see why a patient getting answers inside MyChart leaves it for a tool that has to ask permission to see what Epic already has and can monetize the query.

The RPM Vendor Ban Isn’t About Fraud. It’s About Where the Monitoring Queue Lives

CMS’s proposed 2027 fee schedule would require RPM and RTM monitoring to be performed by direct employees of the billing practice, eliminating outsourced clinical staffing arrangements starting January 2027. CMS is citing OIG findings that 43% of enrollees missed required service components as the justification, and the health system and telehealth industry pushback was immediate.

The fraud framing isn’t wrong, but it isn’t the interesting part. Point-solution RPM vendors operating alongside the EHR just lost their core economic engine. If clinical labor has to be direct-employed, health systems will stop paying third-party SaaS fees and start demanding monitoring queues live inside MyChart, In Basket, and Care Companion instead of a separate vendor portal. That’s a consolidation event dressed as a compliance rule.

The deeper issue CMS isn’t touching is that RPM was forced into a fee-for-service structure that never suited what RPM does well: sustained population management inside a value-based arrangement. A program built for continuous monitoring is a poor fit for proving its worth one billed encounter at a time.

Nobody Owns the AI Tool After It Goes Live, and Seven CIOs Just Said So on the Record

Becker’s rounded up executives from Henry Ford, UT Health San Antonio, Penn Medicine, Sentara, Hackensack Meridian, Intermountain, and Sanford, and the pattern across all seven interviews is the same. Governance is disciplined before go-live. Model reviews happen. Risk assessments happen. Then the tool ships, and ownership quietly evaporates. Henry Ford’s CIO put it plainly: “Once a model is deployed, ownership quietly becomes ambiguous.” Penn Medicine’s data and technology lead made the sharper point: traditional IT was rules-based, so watching workflow was enough. AI tools aren’t rules-based, which means the monitoring has to be a real fraction of the build effort, not an afterthought bolted on after launch.

That’s the diagnostic test for whether an agentic AI deployment is a real co-pilot architecture or just a pitch deck claiming one. If nobody can name the specific human accountable at the specific decision point once the tool is live, “human in the loop” was never an architecture. It was a slide.

There’s a second failure mode next to the monitoring gap, and it deserves its own attention rather than folding into the same complaint. I’ve watched this play out inside multiple organizations, specific enough to each one that it resists a clean industry-wide fix: leadership chases the shiny object, greenlights the pilot, and legal and privacy step in with legitimate concerns about data exfiltration and who retains the intellectual property the tool generates. Those concerns are easy to state in a meeting and much harder to resolve in a contract. The result is a kind of organizational fibrillation, real energy, no coordinated output, where the technology stalls because nobody built the muscle to move a vendor relationship, a legal review, and a monitoring plan at the same speed. Underneath both problems sits the one almost nobody asks first: whether the data foundation exists to make the AI work well to begin with.

Every AI governance framework being built right now assumes the hard part is watching the model. The harder part is that most organizations haven’t agreed on who’s accountable, haven’t resolved what the vendor keeps, and haven’t checked whether their own data was ever fit to build on. The tool going quiet in production isn’t a bug in the monitoring plan. It’s three unresolved fights, inherited by whoever was holding the dashboard when the lights went on.

✅️ Off-Label. Not health IT, not my usual lane, but something that made me think. Here’s why it should matter to people who do what we do.

Dr Sam Illingworth wrote about using AI to self-publish a book about using AI, and the piece that stuck with me isn’t the writing advice. It’s the argument underneath it: AI has made work faster to produce without making it faster to judge, and the jobs getting automated first are exactly the ones where that judgment used to get built. Swap “book” for “clinical note” and the argument doesn’t change at all.

If your organization is quietly widening its AI vendor relationships every time a point solution announces a platform expansion, without ever re-running the question of which lane that vendor is actually filling, this is exactly the kind of Epic problem I work on.

I run a 30-minute Epic Strategy Review. A working conversation, not a pitch. You describe the specific Epic problem you’re wrestling with, I tell you what I see, and by the end of 30 minutes we land in one of three places: a natural next step, an honest “you don’t need me yet,” or a clean “not a fit.” Book some time here.

John Lee is an emergency physician and Epic consultant who helps health systems bridge the gap between Epic’s capabilities and operational reality. He specializes in data architecture, registry optimization, and making Epic’s tools actually deliver results.

Also on LinkedIn and at hitpeakadvisors.com.

🔷 Amazon Pharmacy joined eNavvi and Cost Plus. A transparent-price prescribing economy is forming outside the PBM loop. EHRs will pivot. PBMs and insurers cannot.

🔷 Craneware and Abbott both disclosed breaches. The story is not the vendor. It is the acquired legacy nobody has consolidated since the deal closed.

🔷 The Senate declined to unwind WISeR. AI prior authorization is cleared through 2031. The AI grading Medicare claims was trained on payer AI decisions. Opaque and profitable. It will happen again.

🔷 TEFCA hit 500 million records. That is the floor. The pipes were built for on-premise EMRs, not agents. The notes riding them carry billing noise, not signal.

✅️ Off-Label: Andrew Lundquist on why accountable care fails on translation, not actuarial science. When the record is opaque, translation collapses.

The Feed is a quick take on a few of the highest-profile health IT news items of the week, with one piece from outside the beat at the end. The two Epic quick hits below are free. The full issue is for paid subscribers.

I don’t know what Epic’s leadership shake-up actually means for the company’s product scope, and anyone who tells you they do is guessing. What I can tell you is how to get your Epic environment ready for whatever comes out of UGM instead of reacting to it six months late, and that’s exactly the kind of Epic problem I work on.

I run a 30-minute Epic Strategy Review. A working conversation, not a pitch. You describe the specific Epic problem you’re wrestling with, I tell you what I see, and by the end of 30 minutes we land in one of three places: a natural next step, an honest “you don’t need me yet,” or a clean “not a fit.” Book some time here.

John Lee is an emergency physician and Epic consultant who helps health systems bridge the gap between Epic’s capabilities and operational reality. He specializes in data architecture, data asset optimization, and making Epic’s tools actually deliver results.

Also on LinkedIn and at hitpeakadvisors.com.

Sumit Rana. Seth Hain. Dave Fuhrmann. Drew McCombs. Mark Morris. Five senior Epic executives, all with long tenures, all departing in a window of weeks before UGM. Becker’s reported the latest three yesterday, citing a Second Opinion investigation from July 18. Rana steps down August 14. McCombs left in January to become CTO and CISO at Cylerity. Hain led Epic’s AI efforts and helped build Curiosity and the AI Trust and Assurance Suite. Fuhrmann ran Care Everywhere, the HIE product on which Epic’s TEFCA and QHIN posture sits. Morris is a two-decade veteran in technical services.

I do not know why. My initial read on Rana was that a personal decision was the parsimonious explanation, and I still think that is likely. Hain leaving in the same window makes me pause. The other three leave me open to the possibility that something bigger is happening than individual decisions coinciding.

The pattern inside the list is not random. Rana architected Epic’s outward-facing partnerships, most visibly Cornerstone with Microsoft and the ambient work with Nuance and Abridge. Hain was the public face of Epic’s AI story. McCombs oversaw Nebula, Cogito, and AI. Fuhrmann ran the interoperability spine. Five of the six people leaving ran Epic’s bridges to the outside. That is a category, not a coincidence.

published his pre-UGM prediction the same morning. He argues Epic is about to bring the LLM layer behind Art, Emmie, and Penny in-house, most likely as open-weight adoption running inside Epic’s own environment on Azure. His case rests on Epic’s build-first culture, the Nuance and Microsoft positioning that never held together, Microsoft’s own pivot toward customer-hosted models, and the personnel pattern Becker’s reported the next day.

The parallel I keep returning to is Microsoft in the early 2000s. Windows was the paradigm that made the company what it was. When enterprise arrived as the next paradigm, the company reconstituted what it was for. Not everyone who built the desktop era stayed to build the enterprise one. Epic may be at a similar inflection. What an EHR company needs to be in a world where agentic AI, cross-network exchange, and hyperscaler-brokered infrastructure are the operating environment is genuinely different. The Cornerstone relationship and the Azure-brokered model access were the traces of that widening already visible. Bringing the model in-house is what an EHR company does when it decides the model is part of what it now is.

The reader payoff for a CIO or CMIO watching UGM is not just what gets announced. It is how Epic describes the scope of its own product going forward. Watch who fills Care Everywhere and whether that succession signals the HIE product is still oriented around cross-network exchange or is being repositioned as an internal component of a wider Epic AI stack. What comes home in their place is the actual news of the next month.

A Transparent-Price Prescribing Economy Is Forming Outside the PBM Loop. Amazon Just Signed On.

eNavvi and Amazon Pharmacy announced a collaboration on July 14 putting real-time pricing, availability, and Amazon fulfillment inside eNavvi’s e-prescribing workflow. eNavvi is a physician-founded prescribing platform that received Surescripts E-Prescribing certification on June 29. That certification lets eNavvi route prescriptions independently of the EHR’s native pathway.

The trade press read this as Amazon plus another middleware. What is forming underneath is bigger. eNavvi has been the clinician-facing prescribing surface for Mark Cuban Cost Plus Drug Company since May 2023, with an expanded October 2024 collaboration opening direct prescribing to more than 7,000 independent pharmacies and national grocery chains. What Amazon signed onto is an adjacent settlement being built outside the PBM and insurance loop, with transparent cash pricing as the organizing principle.

The reason the settlement is scaling is the pricing gap. When a patient can buy the same generic for a fraction of the copay their insurance imposed, the value proposition of the middle layer becomes hard to defend. The extractive middle stops being invisible. My prediction is the ask happens sooner than the industry expects. EHR vendors will pivot to it relatively easily because their moat is workflow and data ownership, not the fulfillment channel. The two layers that cannot pivot without eating their own value proposition are PBMs and insurers. Both depend on the pricing being illegible to the prescriber and the patient. Once eNavvi and Cost Plus and Amazon make the pricing legible at the point of care, the extraction is exposed as extraction.

The reader payoff for a CIO, CMIO, or pharmacy director is to watch the ask coming from your patient panel, not the pitch coming from the pharmacy vendor. The question is which of your outpatient specialties sees it first.

Two Vendor Breaches in One Week. Same Underlying Failure. The Acquired Legacy Nobody Consolidated.

Abbott confirmed a cybersecurity incident on July 16 involving unauthorized access to internal legacy Exact Sciences systems in its Cancer Diagnostics business. ShinyHunters claimed responsibility, listed Abbott on its leak site July 15, and set a publication deadline of July 21. Access was obtained July 4 via API endpoints after vishing attacks in mid-June compromised a Microsoft Entra single sign-on account. ShinyHunters claims 30 million rows exfiltrated across Microsoft Entra, ServiceNow, SharePoint, Databricks, and Coupa. Abbott disputes the scope.

Craneware disclosed on July 20 that its Trisus platform environment had been accessed and a significant volume of files exfiltrated, including some employee, customer, and partner records. Craneware supports approximately 2,000 US hospitals and 10,000 clinics and retail pharmacies. Trisus is Best in KLAS for chargemaster. The disclosure went to the London Stock Exchange, and the FBI and UK regulators have been notified.

The pattern nobody has named yet is that both incidents center on acquired legacy nobody consolidated. Abbott acquired Exact Sciences in late 2025 and the confirmed breach is on Exact Sciences legacy systems. Craneware’s exposure blast radius includes roughly 147 million medical records accumulated over two decades, in part through its 2021 acquisition of Sentry. In both cases the sensitive attack surface was the pre-acquisition environment the buyer’s current security posture never fully absorbed. Complexity is where security attention dies. Legacy inherited through acquisition is where the complexity lives. The two together are how attackers get in with disproportionate ease.

The vishing detail from Abbott deserves attention. Voice-based social engineering is entering a phase where AI is faking authenticity and magnifying scale in ways that turn an already effective attack vector into a step-change threat. Video conference-directed variants are the next stage. Training and controls need step-change investment, not incremental improvement.

Audit acquired-legacy environments as a specific category of your third-party risk framework. Which of your material vendors made a substantive acquisition in the last five years, and has the pre-acquisition environment been fully absorbed into current security posture? Whether your BAA counterparty knows the answer is the question you want answered before the next quarterly review.

The Senate Cleared AI Prior Auth Through 2031. The Model Is Grading Claims Against a Corpus AI Wrote.

The Senate voted 46 to 50 on July 16 to reject a Congressional Review Act resolution that would have blocked the Wasteful and Inappropriate Service Reduction model. WISeR launched January 1, 2026, in Arizona, New Jersey, Oklahoma, Ohio, Texas, and Washington. It runs through 2031. It applies prior authorization to skin substitutes, electrical nerve stimulators, and knee arthroscopy for osteoarthritis. Contractors are for-profit vendors compensated on a share of averted expenditures.

The obvious take is that vendors profit from denials. Every trade outlet is running that piece. The pattern underneath is more interesting. WISeR was authorized under CMS Innovation Center authority to waive statutory limits on prior authorization in Traditional Medicare. Beneficiaries specifically chose Traditional Medicare to escape the prior authorization apparatus MA runs. Inside the waiver, CMS committed to a 72-hour standard turnaround and a 48-hour expedited turnaround. Senator Cantwell’s Washington report documents actual wait times of 4 to 8 weeks. That is 9 to 19 times CMS’s own commitment on standard requests. On expedited requests, 14 to 28 times.

Administrator Oz has said clinicians retain final authority to deny services. That claim depends on the human review being a real check on the AI triage rather than a rubber stamp on it. When the payment mechanism ties vendor profit to denial, the check is nominal. Picture a dart board with a small “approve” bullseye and “reject” filling the rest of the target. That is what a payment mechanism looks like when the contractor eats what does not get paid.

The deeper problem is the training data. The WISeR contractors are AI vendors whose training corpus is almost certainly prior authorization decisions largely generated by AI at the MA payer side. That is a supervisor-agent architecture at the policy-infrastructure layer. The model grading the claims and the model that produced the training corpus share the same lineage. There is no external human-validated referent anywhere in the loop.

It would be great to design your Epic environment to help clinicians catch these determinations. But oh, that is right, the WISeR algorithms are probably proprietary. Providers must comply with rules they cannot inspect. That combination, opaque and profitable, is exactly why this pattern will recur. Where there is mystery, there is margin.

Watch the AR aging pattern from January 15 forward in the six states. Appeal aggressively. The 2018 HHS OIG finding was that 75 percent of denied MA prior authorization requests were overturned upon appeal. That prior is the working assumption until WISeR reports otherwise.

TEFCA Hit 500 Million Records. That Is the Floor. Winning Requires Orders of Magnitude More on Rails That Do Not Exist Yet.

TEFCA has reached approximately 500 million records exchanged. Trade press is calling it an adoption milestone. Gene Vestel argues in FHIR IQ Playbook this week that it is the tell, not the finish. The pipes were architected around on-premise EMR infrastructure with constrained compute limits. If every provider and payer hits these pipes simultaneously through dynamic record location services, large portions of the network collapse. The industry roadmap Vestel names is not more pipelines. It is cloud-native data lakes that can process bulk datasets without taking down transactional medical systems.

Vestel is right on the infrastructure. There is a bit more to the story. FHIR, TEFCA, and USCDI are the bare minimum of interoperability. The exchange layer works. The data those standards carry is too coarse to feed AI in any way that would justify the deployments the industry is announcing. The semantic content AI needs is not in the discrete fields. It is supposed to be in the note. The note has been colonized by four decades of evaluation and management billing incentives into a document where copy-paste and template noise have made finding signal nearly impossible. USCDI-conformant exchange guarantees that noise is now portable. The receiving system inherits somebody else’s contamination at network scale.

The governance side of Vestel’s piece is worth pulling out. The traditional standards-body cadence is too slow for the problem it now has to solve.

500 million records is genuine progress and not what winning looks like. Winning requires orders of magnitude more records exchanged, on semantic content dense enough for an agent to reason with, with provenance discipline strict enough that networks do not multiply unverified data by resharing what they did not create. Treat USCDI conformance and QHIN participation as the price of admission. Watch governance moves outside the traditional bodies as the leading indicator of who is building for what comes next.

Five items this week. One pattern. Opacity is the design surface almost everywhere the industry is currently losing. Nobody outside Verona knows what is happening at Epic’s leadership layer because Epic does not discuss personnel. A transparent-price prescribing economy is forming precisely because the PBM extraction was opaque until Cost Plus made it legible. Craneware and Abbott are attackable because the acquired complexity nobody consolidated is opaque to current security posture. WISeR is a proprietary algorithm running a payment mechanism that rewards illegibility. TEFCA celebrates records exchanged without asking what semantic content the records carry. Where there is mystery, there is margin. The largest changes underway this week are attempts to make the mystery legible.

Off-Label. Not health IT, not my usual lane, but something that made me think. Here’s why it should matter to people who do what we do.

Andrew Lundquist posted a physician executive’s read this week on a decade-long shift in how his practice will be paid by Medicare. One accountable care program (ACO REACH) ends December 31, and its ten-year successor (LEAD) starts January 1. Most of the physicians who will be bound have not read the rules. What made me stop was his line: “My CFO can explain the financial methodology to me in twenty minutes. I cannot explain it to my partners in a sentence they will act on.” He calls that his failure. It is not. The right thing to do is massively obscured by complexity and opacity in the underlying data our clinicians actually work inside. Notes bloated with billing incentive noise are not a translation medium. Accountable care does not fail on actuarial science. It fails where every AI deployment fails: the record itself is opaque, and translation collapses because there is nothing legible to translate against.

I don’t know what Epic’s leadership shake-up actually means for the company’s product scope, and anyone who tells you they do is guessing. What I can tell you is how to get your Epic environment ready for whatever comes out of UGM instead of reacting to it six months late, and that’s exactly the kind of Epic problem I work on.

I run a 30-minute Epic Strategy Review. A working conversation, not a pitch. You describe the specific Epic problem you’re wrestling with, I tell you what I see, and by the end of 30 minutes we land in one of three places: a natural next step, an honest “you don’t need me yet,” or a clean “not a fit.” Book some time here.

Delivering healthcare is hard. EHRs have inflicted a death by a thousand cuts. These pieces are the sutures.

Ask three teams how many sepsis patients your hospital treated last quarter. You will get three answers.

The ED points to a dashboard showing 95% bundle compliance and a denominator built from real-time SIRS-plus-suspected-infection firings on the Chronicles side. Quality hands you a SEP-1 abstraction with a smaller denominator, anchored on the ICD-10 sepsis codes present at discharge. Analytics pulls an MS-DRG 871 report from Clarity with a different denominator still, one that lands the hospital in the bottom quartile of the Vizient scorecard that shows up in the CEO’s inbox on Monday.

Three answers, three underlying cohort definitions, none of them wrong on their own terms. Nobody in the room can tell you which one is the real one.

This is not a reporting problem. It is a governance problem, and the specific object of the governance is the diagnosis grouper.

The Chronicles and Clarity split makes this inevitable

Every operational tool in Epic references groupers that live in Chronicles, Epic’s transactional database. Every analytic tool references what got ETL’d into Clarity and Caboodle, the analytic databases, overnight. The ED’s real-time Best Practice Advisory can only fire on a Chronicles diagnosis grouper record. Whether the SQL analyst can see that grouper directly depends on how the ETL is configured and whether she knows to look for it. Most analysts do not know to look. They are so accustomed to building their own grouping mechanisms that they rebuild the logic from scratch in SQL by reflex, because that is what SQL analysts do.

Rebuilding logic in a different language, against a different data model, on a different clock, is the mechanism. Two teams solving the same clinical question in two systems that cannot see each other’s answer will produce two definitions of the population. Add a third team on a fourth build for a research registry and you have four. This is not sloppiness. It is the predictable output of asking every project to define its own cohort in the tool it happens to work in.

Two patients your organization is currently mishandling

A patient walks into the ED with tachycardia and a fever. Influenza is going around. The Chronicles sepsis grouper the ED built (SIRS criteria plus suspected infection, firing on the presenting labs) triggers a sepsis BPA. The clinical team hits the three-hour bundle beautifully. Blood cultures, lactate, broad-spectrum antibiotics, thirty milliliters per kilogram of crystalloid. The ED sepsis compliance dashboard registers a bundle-compliant sepsis case.

Her flu swab comes back positive that evening. She improves on supportive care. She is discharged the next day with an ICD-10 code of J09.X1, influenza with pneumonia. Sepsis is nowhere in her final coding.

The analytics team’s SQL query, which pulls from ICD-10 sepsis codes at discharge, does not know she exists. The ED dashboard counts her as a bundle-compliant win. Analytics counts her as nothing. Two teams cannot even agree on whether the same patient had sepsis, and both are internally consistent.

A second patient has elective knee replacement, uncomplicated surgery. On post-op day five, he develops a central line infection in the ICU and slides into septic shock. The ED sepsis grouper never sees him because he was never in the ED for this admission. The ICU has its own BPA off a different grouper, tuned for a different presentation pattern, and it does not fire in time. The three-hour bundle timeline is missed by hours.

He survives, spends nineteen days in the ICU, and gets discharged with MS-DRG 871, severe sepsis with major comorbidity. Analytics flags him as a bundle failure and a high-cost mortality outlier for the Vizient submission. The ED director rejects the analytics report because his dashboard shows pristine metrics. Both teams are right about the data they are looking at. Both are looking at different data.

The inventory nobody has done

Before you can govern anything, you have to see what you have. At most large Epic organizations, the diagnosis (EDG) grouper (VCG) master file holds dozens of sepsis-adjacent records. Each was built for a different project. Each reflects the code system that was in use when the analyst started, ICD-9 or ICD-10, SNOMED, or a hybrid. Each is owned, nominally, by a person who may no longer work at the organization. Nobody has looked at the full inventory in one place because nobody has been asked to.

The inventory alone is a strategic revelation. When leadership sees the list, the reaction is universal: some version of “how did we let this happen?” The answer is that nobody let it happen. It happened by default, one project at a time, over a decade.

Governance starts here.

The analytic side has the same problem in a different language

Because BI analysts cannot reference the Chronicles grouper directly, they encode the definition into a SQL subquery, park it inside a stored procedure, and insert a copy into whichever downstream report needs it. Change the sepsis definition upstream and you change nothing about the downstream reports until each analyst edits her own subquery.

The Chronicles side has an EDG file with dozens of duplicative sepsis records. The analytic side has stored procedures scattered across every report library, each with a hand-coded definition of sepsis. Neither side has a canonical answer. The two sides do not reconcile because they cannot reference each other.

What the chaos actually looks like

What governance actually looks like when you build it

The consolidation methodology mirrors the OPA governance work covered in the previous EHR Sutures piece. Different object, same enterprise infrastructure.

Start with the inventory. Every sepsis-adjacent grouper in EDG gets pulled into a working list, with owner, last modification date, and the project it was built for. Groupers with no living owner get flagged. Groupers built for expired projects get flagged. Groupers with substantially overlapping definitions get grouped together.

Then run the consolidation review. A committee with clinical, quality, informatics, coding, and analytics representation looks at every group and designates a canonical grouper. The effort does not center on the traditional memos, meeting notes, or a collection of old email threads. It is a metadata record attached to the canonical grouper itself, with a discrete review date, the responsible owner, and the analytic and operational scope the definition is intended to serve. The other groupers in the group either get retired or get formally linked to the canonical grouper as an approved variant, with a stated reason for the variant’s continued existence. The stated reason is the piece that keeps the exception from quietly becoming the next rogue grouper.

Then wire the analytics. The ETL process pulls the canonical grouper’s flag directly into a shared dimension table in Caboodle. Every downstream report replaces its hand-coded SQL subquery with a reference to that dimension. The Chronicles grouper and the Caboodle dimension are now the same population by construction. Any change to the definition propagates automatically because there is nothing downstream to hand-edit.

Then hardcode the conventions. Enterprise rules block the creation of a new sepsis-adjacent grouper if the consolidation review is outstanding. Any new build requires a committee review before it can be referenced by a live tool. This is the piece most organizations skip. Without it, the inventory chaos rebuilds itself within a year, one well-intentioned project at a time.

Cohort governance is not an analytics discipline

The temptation is to treat this as an analytics discipline, something the reporting team owns and the rest of the enterprise consumes. That is exactly wrong.

The cohort is what the institution believes about itself. When leadership sees a sepsis compliance number, when the C-suite reacts to a Vizient scorecard, when the ED celebrates a bundle-compliance win, they are consuming a cohort. The cohort is not an ad hoc downstream artifact. It is the foundation the whole institution’s sepsis story rests on.

The same argument holds for every diagnosis grouper the organization uses to cohort patients. Sepsis is often the worst offender at large organizations and often the hardest to solve. It fails frequently, and each failure has direct impact on quality reporting, regulatory reporting, clinical operations, finance, and research. Every team owns a piece of that failure, and every team has built its own definition to defend its piece. Heart failure, AMI, stroke, and diabetes follow the same template. The specific piece you are reading is about sepsis. The general piece you should be worrying about is every high-volume diagnosis that has a quality measure or a registry attached to it.

The AI move that makes this urgent

The reason this cannot stay a project-level annoyance any longer is that the tools that ask “who has sepsis” are about to multiply.

Every agentic AI deployment that cohorts patients, whether screening for eligibility, prioritizing intervention, or feeding a supervisory model, will pick one of the definitions in your organization’s chaos. It will not tell you which one. It will not tell leadership which one. The population the agent acts on will be a subset of the population the C-suite thinks the organization is treating.

Grouper governance is a concrete, basic foundation problem for AI agents in Epic environments. Most organizations have not done meaningful governance work on their groupers. Agent Factory and any cohorting-dependent agentic tool will amplify the organizations that have governed their cohorts, and it will silently punish the ones that have not.

Ask the same three teams a year later

The VCG file that used to hold six overlapping sepsis EDG groupers now holds one canonical grouper, five retired records, and a governance committee as the responsible owner. The metadata record attached to the canonical carries a discrete review date, so the file cannot silently drift back into inventory chaos.

The SQL that used to hand-code an ICD list joins to a shared dimension. The definition lives upstream in Chronicles. Any change to the CMS ICD list propagates without any analyst editing anything downstream. The stored procedures across the report library that used to disagree now agree by construction.

The ED dashboard, the SEP-1 abstraction, and the Vizient scorecard now share a denominator and tell the same story. The ED number came down. That was the point. Governance revealed how much of the previous 95% was inflation from a cohort that counted viral flu as sepsis wins. The organization now knows what it is measuring, which is the prerequisite for improving on it.

The closing

When you ask an organization to name its sepsis cohort and you get three answers, the failure is not that the answers are different. The failure is that the organization did not know they were different until somebody asked.

If your teams give three different answers to how many sepsis patients you treated last quarter, or if you recognize the broader pattern of Chronicles-side and Clarity-side definitions quietly diverging across dashboards, quality abstractions, and Vizient submissions, this is exactly the kind of Epic problem I work on.

I run a 30-minute Epic Strategy Review. A working conversation, not a pitch. You describe the specific Epic problem you’re wrestling with, I tell you what I see, and by the end of 30 minutes we land in one of three places: a natural next step, an honest “you don’t need me yet,” or a clean “not a fit.” Book some time here.

John Lee is an emergency physician and Epic consultant who helps health systems bridge the gap between Epic’s capabilities and operational reality. He specializes in data architecture, registry optimization, and making Epic’s tools actually deliver results.

Also on LinkedIn and at hitpeakadvisors.com.

• When Epic’s FHIR API authenticates users does it know the “user” is a bot?.

• KLAS just handed CMIOs a seven-point board argument for AI. The number measures a productivity gain. We need a redesign.

• States are writing their own ambient AI disclosure rules. AI is about to be embedded in every piece of care. This is 1998 regulation for 2030 infrastructure.

• Three clinicians published the same argument in one week. Your EHR is a noisy sensor array nobody calibrates. What is the AI grading itself against?.

• Germany set another fax deadline. GeDIG will probably slip too. The rails still get built. The country that has not built any new track in fifteen years is us.

• Off-Label: Zeke Emanuel and Kevin Schulman on the $1.5 trillion billing complex. The AI chatbot war on billing is a Russia-Ukraine stalemate. Only the arms dealers win.

The Feed is a quick take on a few of the highest-profile health IT news items of the week, with one piece from outside the beat at the end. The two Epic quick hits below are free. The full issue is for paid subscribers.

If you need help configuring your Epic environment to support these capabilities, connect with him on LinkedIn or via his website. Book some time here.

Bunkerhill Health closed a $55 million Series B on Wednesday. Innovaccer launched Gravity for Infusion the same day. Both promise autonomous operations layers stacked above Epic. Will either authenticate the agents they intend to run?

Bunkerhill has University of Texas Medical Branch running twenty-plus of its AI agents in production and Cleveland Clinic and Intermountain Health as named customers. Innovaccer’s Gravity press release promises “configurable human review at any point” of an ops layer above Epic, pharmacy, and payer systems. Both vendors are pitching what serious health-IT operators have been asking for: AI that scales the human, with human review at every decision boundary. Both are also stacking that architecture on top of an Epic FHIR authentication layer that was never built to authenticate agents. HealthBit Intel’s July 17 analysis put the gap on the table: the APIs authenticate the user, not the actor. When an agent inherits a user’s full resource scope, will there be breadcrumbs distinguishing a human decision from a machine one? What if HTI-6 or a state OCR review requires an audit and asks which decisions were human, bot or hybrid?

landed the accountability point earlier this week in clinicians.build: “if an agent improperly discloses PHI, OCR won’t care whether it was a person or a machine. You’ll still be accountable.” The same issue described Delaware routing real-time eligibility and prior authorization through a single neutral statewide hub built on DHIN.

Healthcare regulation has been designed at the endpoints. ACA at coverage. Meaningful Use at physician workflow. Medicare Advantage at payment. Rigid specifications for the stations and rail-car amenities. What was never built at national scale is Eisenhower’s Interstate for health information: standards, semantics, data quality, coordinated authority. Regulate the tracks. Let the market build cars and stations for a system that actually connects. Because the tracks were never built, every autonomous-ops vendor now builds its own specs. A health system running twenty Bunkerhill agents plus a Gravity infusion layer has no cross-agent governance, no shared vocabulary, no way to interface with the surrounding Epic environment without proprietary translation. When two agents try to alter the same care plan simultaneously, nobody knows which one wins or why. The scaling story doesn’t fail. It industrializes the friction it was supposed to remove. This is the industry’s optimization bucket at fifty-million-dollar-round scale, with configurable human-in-the-loop as the marketing sticker on the outside.

For a CIO signing either contract this quarter, one clause worth insisting on in plain English: your agent and my EHR have to speak the same language, and prove it on every exchange. When a term in the shared vocabulary changes, a code retires, a data field means something different, the system has to detect the drift, correct the affected records, and refuse to keep operating on stale definitions. Any vendor who can’t hand me evidence of both directions working, live, is asking me to trust that the meaning didn’t and won’t ever change. These things always change.

Twelve Progressive Epic Organizations Reported 7 Points Higher. Is That the Measurement We Want to Follow?

KLAS Arch Collaborative 2026 documents Epic organizations with AI users scoring 7 points higher on the belief that the EHR enables operational efficiency (Net EHR Experience Score 72.2 vs. 64.9), with the spread led by order creation (+9%), shift and patient-stay summaries (+6%), and EHR data discovery (+5%). The findings make a whole lot of sense. Three caveats:

1. The dataset is from twelve “progressive” Epic organizations who opted into the Arch Collaborative, so the number is not the industry average.It’s the industry as measured on organizations already doing the work well.

2. The 7-point gap is a perception metric, closer to the LLM-hallucination-confidence problem than to an outcome measure.

3. And the efficiency gains are “faster horse” operational tasks. Real value but not the redesign we need.

I repeat Brynjolfsson’s metaphor from The Second Machine Age because the pattern keeps repeating. Electric motors delivered their productivity gains not when they replaced steam engines inside the same factory architecture, but when the factory floor was rewired for distributed power. It was a twenty-year gap between the arrival of the technology and the redesign that unlocked its potential. The Arch Collaborative’s 7-point spread is the productivity gain from bolting electric motors onto a steam-era factory floor. Genuine and worth capturing but also nibbling at the edges of what the technology could do if the floor were redesigned around ambient capture, agentic action, and reasoning primitives. I personally think there is a 10x or 100x delta nobody is measuring yet.

In the training deficit KLAS documents, 75% of clinicians using AI say they were not adequately trained to validate AI-generated content in active workflows, is the tell. You do not need 75% training coverage to run a faster horse. You need it to run a different kind of horse.

Read more

• The real Texas v. Epic story isn’t the State’s case. Five stakeholders are objecting at the same time.

• Matthew Crowson published the matrix every Epic organization should have built. Epic has a high EMR ceiling. Reaching it is on the org.

• NHS bought a faster horse at national scale. What ambient AI ate was legacy medicine’s documentation debt.

• OpenAI signed eight hospital systems. HHS pointed ChatGPT at $2.1 trillion of billing files the same week. Nobody is asking about the data cannibalism loop.

• CY 2027 physician payment cuts are also charge capture reconfiguration work. Both sides of the ticket need to see the other side.

• Off-Label: Topol’s organ-aging clocks reach the actuarial framework before surrogate endpoints resolve. Goodhart’s Law is already sharpening the knife.

The Feed is a quick take on a few of the highest-profile health IT news items of the week, with one piece from outside the beat at the end. The two Epic quick hits are free. The rest of the issue is for paid subscribers.

If you need help configuring your Epic environment or navigating operational-to-configuration gaps, connect with me on LinkedIn or via my website. Book some time here.

The State of Texas served proofs of service on five third-party subpoena targets July 9: Oracle, athenahealth, eClinicalWorks, Palantir, and Baylor Scott & White. All five are refusing to produce documents until Epic’s in-house counsel is walled off from discovery. Ten third-party subpoenas are outstanding. Epic has filed counter-subpoenas on at least four of the same parties. Athena and eCW were not in Texas’s February initial disclosures, so the reach of the case has expanded. has been tracking the story and it potential antitrust themes.

The industry read will be that Texas is going after Epic. That is only part of the story. The other side is the collective refusal. Three direct competitors, one customer, and Palantir all landing on the same procedural objection at the same time is not procedural coincidence. Is it an implicit fear that Epic’s legal team can weaponized in commercial relationships that never reach a courtroom? Texas moved to install an Outside Counsel Eyes Only tier to solve exactly this. Epic pushed back. Hearing is on August 7.

Epic likely is arguing outside litigators do not understand Chronicles or how healthcare data actually moves between systems, so Epic’s own developers and informatics specialists have to sit in the review room. Its executives need to see pricing models and interface agreements to guide deposition strategy and its cross-subpoena strategy depends on internal teams running incoming competitor data against Epic’s own market plans. Every one of those arguments describes exactly the mechanism the other five implied in refusing to produce.

The bigger thread is why athena and eCW entering the case matters more than the OCEO fight itself. When ambulatory-native cloud EHRs get subpoenaed alongside Epic, Oracle, and a systems integrator, the State is no longer investigating one company’s footprint. It is subpoenaing the competitive baseline of the entire market to map where data actually moves and where it is blocked. That is a state-level judicial analog of 21st Century Cures enforcement, fought through an antitrust(ish) lens instead of the ONC framework. Interoperability has been correctly identified as a data standard problem but that always has been a network and incentive problem in disguise.

Epic Has a High Ceiling. Reaching It Is on the Organization.

Matthew Crowson published the first installment of Vitals & Variables, a three-part LinkedIn Newsletter series. It opens with a downloadable matrix of 62 real EHR requirements, with 25 hard gates where one failure fails the build. He also included an airport-kiosk-curve joke about EHRs grading F on usability. Parts 2 and 3 grade the open-source ecosystem and address migration risk and liability. He has committed to standing up a working prototype and publishing whether it collapses under its own gates.

I do not know any Epic organization that has run Crowson’s matrix or anything like it formally against its own build. What organizations do instead is what you would expect. Something fails a gate operationally, an ad hoc project spins up, it either gets prioritized this cycle or it does not, and the gates that do not resolve carry into the next build cycle. That is what I have previously positioned as PDPDPD without a Study/Act step.

The reframe I want the reader to understand is that usability is not an EHR-level property. KLAS Arch Collaborative data has made this point for years. Epic’s floor is similar to every other EMR’s floor (ie: bad). Its ceiling is much higher. Getting to the ceiling is entirely a function of local configuration and local culture. Crowson’s matrix applied against an Epic build would tell an organization which of its failing gates are Epic gates and which are its own build gates. The answer is frequently not the answer leadership expected walking in. I would love to see a Part 4: Epic-graded-against-Crowson. The Epic organizations that work the process internally will find their real optimization backlog.

Read more

Watch a physician produce a note in Epic today. She opens the chart, and without a click, the past medical history, the medication list, the vitals, and the exam pour onto the page already formatted. A minute later there is a complete, clean, billable note. Now, before the synthesized summary tells her, ask her what she thinks is wrong with the patient. What past history and medication is important? Do any vitals change her decision making?

There is a debate running through my corner of medicine right now about whether AI scribes will change how doctors think. Helen Ouyang wrote a careful essay on it for the New York Times, and Spencer Dorn’s LinkedIn thread drew a crowd of physicians all worrying about the same thing: if writing is thinking, what do we lose when the machine does the writing? It is a good question. It is also about fifteen years late.

The Note Was a Speedbump. We Paved It.

Larry Weed gave us the SOAP note because he wanted a physician’s reasoning to be organized and visible on the page. Subjective, objective, assessment, plan. It communicated what was wrong with the patient and what we wanted to do about it. However, the note product was not the sole reason to create the note. The structure also forced a sequence: gather, examine, consider, then commit to what you think and what you will do about it. Writing it was slow, and the slowness was the feature. You could not produce the assessment without first holding the subjective and the objective in your head long enough to reconcile them. The note was a speedbump, and the speedbump made you think.

The EMR paved the speedbump over. Documentation became a trick you perform with a click: pull the history forward, drop in the template, let the vitals flow in from the monitor, and the page fills before you have formed a single thought about the patient in front of you. Physicians trained after that shift never met the speedbump. They do not experience writing a note as contemplation because in their entire career it never was. The process was assembly, not thinking. The cognitive work Weed designed the note to force got engineered out of the workflow, quietly, one convenience at a time.

Deskilling Isn’t a Convenience Story in Medicine.

There is a word for what happens when a technology takes over a task and you slowly lose the ability to do it yourself. Deskilling. In most of life it is a fair trade. I cannot navigate by the stars and I do not need to, because the map on my phone has never once failed me in a way that mattered.

Medicine is not like that. The friction we keep sanding off, writing the note from scratch, being asked what you think before you are told, reading a history long enough to notice the thing that does not fit, is the exact mechanism by which a clinician learns to reason. I talked through this here. Take it out and you get two things at once: faster notes, and worse doctors. The linkage between these two phenomena should concern us. The clinician who leans hardest on the generated summary is the one who never built the skill to catch it when it is wrong. We are taking the training wheels off the bike before anyone has learned to ride.

I Built the On-Ramp.

I need to stop narrating this as though I am a passive observer. I am not. I helped build the deskilling on-ramp.

My start in informatics was not high-minded. It was me, early in my career, figuring out how to help my fellow physicians game the system with the EMR. I got myself trained as a Meditech PDOC analyst, the documentation module, specifically so I could make the note easier to produce. This was 2009, before HITECH, before Meaningful Use, before anyone was paid or punished into any of it. I taught myself Dragon when it still shipped on a CD-ROM and installed off a disk drive. And I got seventy percent of my physicians using it, with no stick, no mandate, nothing but a carrot.

The carrot was control. Instead of dictating into a phone and waiting a day or two for a transcriptionist to hand their words back to them, they could speak and watch the note appear and own it immediately. They loved it. I was good at giving it to them.

I still think the carrot was real. Telephone dictation was slow and it was very asynchronous. There were many times I would dictate hours after I saw a patient with only a vague recollection of the encounter. I was not wrong that the friction of dictation deserved to die. I just didn’t see at the time that I was also sanding down a different friction, the one that made a physician stop and think before the words existed. I removed both and called the whole thing a gift. For years I only counted the good half.

SOAP Was Built for Paper. We Don’t Have Paper.

How did the friction get there and why do we have it? Larry Weed did not choose SOAP because it captured how reasoning truly worked. He chose it because paper could not hold anything richer or dynamic. A sheet in a folder has hard limits: it cannot cross-reference, it cannot update itself, it cannot show you the same data four ways, and it cannot automatically pull in volumes of data from within the chart. The conventions we are now mourning are artifacts of a medium we already abandoned. We lost the paper but kept the format.

In the process, the volume genuinely changed. A modern chart is an enormous pile: labs, imaging, outside records, years of encounters, device data, message threads. No clinician can absorb that unaided, and pretending otherwise is its own kind of malpractice. When ambient documentation listens to a visit and produces a coherent synthesis, or when a model reads the pile and hands back a summary that is actually usable, that is not hype. That is real help for a real problem. The frictionless path is not the enemy. Some of the friction it deletes was never doing anything for anyone except honoring a paper format and the billing artifacts that spawned from it.

So the question was never, “Is friction good or bad?” It is which friction helps the clinician and which friction is just a residue of paper’s legacy. Much of the discussion on Spencer’s thread does not separate the two. The note still has purpose. We just need to match the purpose with the medium.

Train the Friction In. Then Let It Go.

Here is what I have advocated for medical students: write the whole note by hand. No templates, no pull-forward, no linked data, nothing populated for you. Read the history yourself and decide what matters. Do the exam and write what you found in your own words. Reconcile the subjective and the objective yourself and commit to an assessment before anything external confirms it. It is slow and it is miserable and it does not scale, and none of that is the point. It is not a workflow. It is a gym. You do it so the reasoning gets built into you while you still have the chance, so that later, when the machine does the writing, you are the editor who can tell when it is wrong instead of the one who cannot.

That is the move both sides of the debate keep missing. You do not have to choose between preserving Weed’s note forever and surrendering the reasoning it protected. Keep the friction where it teaches, in training, on purpose, in a form you would never inflict on a working clinician. Then take it out everywhere it is only paper’s ghost, and go build the thing Weed would have built if he had our tools instead of a folder and a pen. He was not defending a format. He was defending thought. We honor him by doing for our era what he did for his, not by freezing his answer in place.

And the thing worth building shouldn’t be a better-looking note. The note was all paper could carry. We can “write” in ways that paper never allowed us. We can have it be dynamic and show only certain things based on context. We can have it spin off discrete data to feed downstream analytics and population health. We can collect social and symptomatic context that would have been lost on paper. The frictionless summary that only reproduces the old note faster is the least interesting thing this technology can do.

I would put those physicians on Dragon again tomorrow. The carrot was real and I do not regret giving it to them. What I regret is that I thought I was only adding something, when I was also quietly removing something, and it took me the better part of a career to see the second half of the ledger. The training wheels are coming off the bike whether we like it or not. The only question that matters now is whether anyone made sure the rider learned to ride first.

John Lee is an emergency physician and Epic consultant who helps health systems bridge the gap between Epic’s capabilities and operational reality. He specializes in data architecture, registry optimization, and making Epic’s tools actually deliver results. If you need help configuring your Epic environment to support these capabilities, connect with him on LinkedIn or via his website.

• Mayo’s celebrated AI governance framework was the industry template two weeks ago, and this week it is a federal complaint alleging a concealed 67% error rate and an HR ghost file

• BillionToOne is now ordering-and-resulting inside Epic Aura, and the trade Epic quietly won is the discrete molecular data layer that will feed Cosmos

• CMS is standing up its own federated FHIR alternative to TEFCA, and the question is whether the pipes get cheaper, or just different

• HBR documented that treating AI agents as coworkers erodes the accountability the tools need to be safe, but are agents coworkers or copilots?

• OpenEvidence funded a study that says OpenEvidence beats the general-purpose LLMs that another study said beat OpenEvidence, and we should really stop paying attention

• Off-Label: assistant surgeons are billing $22,000 an hour through a loophole nobody sees in aggregate, and where there is mystery, there is margin

The Feed is a quick take on a few of the highest-profile health IT news items of the week, with one piece from outside the beat at the end. The two Epic quick hits are free. The rest of the issue is for paid subscribers.

If you need help configuring your Epic environment or navigating operational-to-configuration gaps, connect with me on LinkedIn or via my website.

Two weeks ago the industry pointed at Mayo Clinic Platform’s AI governance framework as the practical template for the Agent Factory era. Executive-led oversight. 100-plus applications reviewed. A written prohibition against deploying complex AI in time-urgent clinical scenarios without proactive human review. This week the same Mayo is on the receiving end of a federal complaint. Traci Tamiko Eto, hired December 2023 as Director of Research Operations specifically to align Mayo with the 2023 White House executive order on AI governance, filed suit July 6 in U.S. District Court in Minnesota alleging that she was systematically excluded and fired for raising concerns about Mayo’s internal MAYA digital assistant. The complaint’s central allegation is a concealed 67% error rate, flagged in ten separate whistleblower reports, on a tool that was approved and exempted from IRB inspection anyway. Becker’s carried the summary. The Post Bulletin also reported on the complaint, including a senior leader’s alleged line that resolving the issue would cost “political capital” he was unwilling to spend.

To be clear, MAYA is not an Epic Cosmos artifact. Mayo has been a prominent Cosmos nonparticipant. Mayo Clinic Platform is a direct competitor to Cosmos.

My read, pending confirmation from the litigation record, is that MAYA is a RAG layer sitting on top of Mayo’s production Chronicles database, designed specifically to handle the messy fragmented nature of EHR clinical notes. That is the interesting technical claim underneath the governance drama. Unstructured clinical notes are a genuinely bad source for retrieval-augmented generation, because the note corpus is contradictory, provisional, and full of documentation-for-billing artifacts. A 67% error rate against those notes is not an outrageous outcome. It is what you would expect when the RAG layer treats an unstable corpus as ground truth. The scandal is not that MAYA hallucinated. The scandal is that ten internal whistleblowers said it was hallucinating, and the process that was supposed to catch it, waved it through.

The second thread the complaint alleges is the “ghost file” — a compliance-department mechanism that flags former employees who raised concerns as ineligible for rehire in external verification systems. Compliance departments are supposed to be the risk-mitigation function that catches exactly this class of failure. What happens when they instead become the corporate enforcement arm, protecting the technology margin that leadership refused to spend political capital on? If the 67% error rate can be verified, it is the receipt for how difficult clean data inside even a world class EHR environment really is. The ghost file is the receipt for how the institution behaves when large technology margins are at stake.

Epic Just Won the Molecular Data Layer It Wasn’t Going to Build

BillionToOne is now order-and-resulting directly inside Epic’s Aura diagnostics suite. Clinicians can order UNITY Complete prenatal testing and Northstar Select and Response liquid biopsy from within Epic. Discrete results flow back into the EHR and can drive downstream clinical decision support. This is a genuine win for both parties, and it is worth naming what each side actually got.

BillionToOne got access to the dominant system of record and everything that comes with it, including the Cosmos flywheel over time. Epic got specialty molecular content that was not in any of its development timelines, and more consequentially it got the discrete genomic and oncology data flowing natively into the EHR rather than sitting siloed in a PDF an oncologist has to pull up in a separate window. Epic is using Aura to crowdsource the structured molecular data layer that Epic and Cosmos can leverage downstream to create precision-medicine workflows. This is the four-lane framework I laid out in Epic’s Kryptonite Isn’t Lotus executing in production. BillionToOne is doing work Epic doesn’t do, on data Epic can’t reach, using external content Epic isn’t in the business of producing. Both parties get real synergy that neither could build alone. The molecular result that used to sit in a specialty portal is now discrete data hitting a Registry. That will transform the CDS layer from a carpet bombing of alert fatigue to a laser guided alerting system.

The catch is the same catch as everything else. The tool arriving is not the same thing as the tool firing. Discrete results routing back into Chronicles do nothing until an organization builds the Registry, the SmartData Element, and the BPA that use them. That build discipline is still ninety percent on the table across the Epic install base. BillionToOne shipped the plumbing. What comes out of the faucet is on you.

Read more